From c80bbf26a10acaba18b2333aee609529cdbee3d9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 7 Aug 2024 11:58:53 -0700 Subject: [PATCH 1/4] updating dashboard with yamls --- contentctl | 1 + dashboards/{escu_applocker.json => applocker.json} | 2 +- dashboards/applocker.yml | 6 ++++++ dashboards/rmm_software_tracking.json | 0 dashboards/rmm_software_tracking.yml | 6 ++++++ 5 files changed, 14 insertions(+), 1 deletion(-) create mode 160000 contentctl rename dashboards/{escu_applocker.json => applocker.json} (99%) create mode 100644 dashboards/applocker.yml create mode 100644 dashboards/rmm_software_tracking.json create mode 100644 dashboards/rmm_software_tracking.yml diff --git a/contentctl b/contentctl new file mode 160000 index 0000000000..34aa0b12df --- /dev/null +++ b/contentctl @@ -0,0 +1 @@ +Subproject commit 34aa0b12df44c0cc611e66a4549b9b37f3e28417 diff --git a/dashboards/escu_applocker.json b/dashboards/applocker.json similarity index 99% rename from dashboards/escu_applocker.json rename to dashboards/applocker.json index 285ee157a1..ce8ec3b221 100644 --- a/dashboards/escu_applocker.json +++ b/dashboards/applocker.json @@ -371,7 +371,6 @@ "input_q9ZwkL2y" ] }, - "title": "ESCU - AppLocker", "defaults": { "dataSources": { "ds.search": { @@ -384,5 +383,6 @@ } } }, + "title": "AppLocker", "description": "Utilize this dashboard to assist with auditing and monitoring Windows AppLocker events for your endpoints. Configure the applocker macro to use the AppLocker data source for populating the dashboard." } \ No newline at end of file diff --git a/dashboards/applocker.yml b/dashboards/applocker.yml new file mode 100644 index 0000000000..fca6ec40a2 --- /dev/null +++ b/dashboards/applocker.yml @@ -0,0 +1,6 @@ +name: AppLocker +id: b13032c2-f0e2-48ee-8a85-ded8956c012a +version: 1 +date: '2024-05-21' +author: Michael Haag, Splunk +description: Utilize this dashboard to assist with auditing and monitoring Windows AppLocker events for your endpoints. Configure the applocker macro to use the AppLocker data source for populating the dashboard. \ No newline at end of file diff --git a/dashboards/rmm_software_tracking.json b/dashboards/rmm_software_tracking.json new file mode 100644 index 0000000000..e69de29bb2 diff --git a/dashboards/rmm_software_tracking.yml b/dashboards/rmm_software_tracking.yml new file mode 100644 index 0000000000..86ed42ee98 --- /dev/null +++ b/dashboards/rmm_software_tracking.yml @@ -0,0 +1,6 @@ +name: RMM Software Tracking +id: 824b748b-9746-4247-b02b-f0961d6f54a5 +version: 1 +date: '2024-08-05' +author: Steven Dick, Github Community +description: Utilize this dashboard to assist with auditing and monitoring Windows AppLocker events for your endpoints. Configure the applocker macro to use the AppLocker data source for populating the dashboard. \ No newline at end of file From 96328431d38d3a61d5c51d63a529690f3d445db5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 7 Aug 2024 16:17:01 -0700 Subject: [PATCH 2/4] moar updates and tested succesfully --- .../default/data/ui/views/escu_applocker.xml | 401 ----------- dashboards/rmm_software_tracking.json | 680 ++++++++++++++++++ 2 files changed, 680 insertions(+), 401 deletions(-) delete mode 100644 app_template/default/data/ui/views/escu_applocker.xml diff --git a/app_template/default/data/ui/views/escu_applocker.xml b/app_template/default/data/ui/views/escu_applocker.xml deleted file mode 100644 index 8bc453fe16..0000000000 --- a/app_template/default/data/ui/views/escu_applocker.xml +++ /dev/null @@ -1,401 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/dashboards/rmm_software_tracking.json b/dashboards/rmm_software_tracking.json index e69de29bb2..b24d80dfc8 100644 --- a/dashboards/rmm_software_tracking.json +++ b/dashboards/rmm_software_tracking.json @@ -0,0 +1,680 @@ +{ + "visualizations": { + "viz_total_overtime": { + "type": "splunk.line", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "xAxisTitleText": "status", + "xAxisTitleVisibility": "show", + "yAxisTitleText": "count", + "yAxisTitleVisibility": "show", + "y2AxisTitleVisibility": "show", + "seriesColorsByField": {}, + "legendDisplay": "off", + "nullValueDisplay": "zero" + }, + "dataSources": { + "primary": "ds_2OvlCBpy" + }, + "eventHandlers": [], + "title": "RMM - Timechart", + "showProgressBar": true, + "description": "Count of total RMM detections in the environment over time ( unapproved / unknown )" + }, + "viz_alert_by_analyst": { + "type": "splunk.line", + "dataSources": { + "primary": "ds_YTrlswJz" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature = $name|s$", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ], + "title": "RMM - Timechart by RMM", + "showProgressBar": true, + "description": "Count of unique RMM detections seen in the environment over time ( unapproved / unknown )", + "options": { + "nullValueDisplay": "zero" + } + }, + "viz_alert_by_host": { + "type": "splunk.bar", + "dataSources": { + "primary": "ds_4jEl4LX9" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature=$row.signature.value|s$", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ], + "title": "Top RMM Software", + "showProgressBar": true, + "description": "Most frequent RMM Software detections", + "showLastUpdated": false, + "options": { + "legendDisplay": "off", + "stackMode": "stacked" + } + }, + "viz_alert_by_user": { + "type": "splunk.table", + "dataSources": { + "primary": "ds_SDnZFhvW" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=$row.source.value|s$ signature=$row.signature.value|s$", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ], + "title": "Risk Detection Events", + "showProgressBar": false, + "showLastUpdated": false, + "hideWhenNoData": true + }, + "viz_5zPh9TFb": { + "type": "splunk.singlevalue", + "showProgressBar": false, + "showLastUpdated": false, + "title": "Unique RMM Software Detected", + "description": "Count of unique RMM software seen", + "dataSources": { + "primary": "ds_9UEKEzwj" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count values(src) as src, values(dest) as dest, values(user) as user, values(process_name) as process_name, values(file_name) as file_name, values(url) as url by source,signature,_time \n| stats count by signature\n| sort - count", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ] + }, + "viz_B31XW5SU": { + "type": "splunk.singlevalue", + "title": "Monitored RRM Software", + "description": "Total known and monitored RMM software", + "dataSources": { + "primary": "ds_XuRUkYYm" + }, + "options": {}, + "context": {}, + "showProgressBar": false, + "showLastUpdated": false, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| inputlookup remote_access_software\n| stats values(*) as * by description\n| fields - last_update,isutility,category\n| sort description", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ] + }, + "viz_pmYQoySR": { + "type": "splunk.singlevalue", + "title": "Total RMM Software Detections", + "dataSources": { + "primary": "ds_0ZD3LOc8" + }, + "showProgressBar": false, + "showLastUpdated": false, + "description": "Total risk detections fired for RMM software", + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ] + }, + "viz_wWQo64yc": { + "type": "splunk.singlevalue", + "showProgressBar": false, + "showLastUpdated": false, + "title": "Monitoring Exceptions", + "description": "Total count of exceptions made for RRM software", + "dataSources": { + "primary": "ds_I4IUb8eZ" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| inputlookup remote_access_software_exceptions", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ] + }, + "viz_8XkPozlC": { + "type": "splunk.singlevalue", + "title": "Total RMM Software Alerts", + "dataSources": { + "primary": "ds_AdgNL7xF" + }, + "showProgressBar": false, + "showLastUpdated": false, + "description": "Total alerts triaged with RMM software detections", + "eventHandlers": [ + { + "type": "drilldown.customUrl", + "options": { + "url": "/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=$time_picker.earliest$&latest=$time_picker.latest$&search=%2522ESCU%2520-%2520Detect%2520Remote%2520Access%2520Software%2520Usage*%2522", + "newTab": true + } + } + ] + }, + "viz_xMCkeXlQ": { + "type": "splunk.sankey", + "dataSources": { + "primary": "ds_LW7LiOhy" + }, + "title": "Top Detections to RMM Software", + "description": "RMM Software detection to software affinity" + }, + "viz_NI1GGlJo": { + "type": "splunk.bar", + "dataSources": { + "primary": "ds_rh3uALwl_ds_4jEl4LX9" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature=$row.signature.value|s$", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ], + "title": "Rare RMM Software", + "showProgressBar": true, + "description": "Least seen RMM Software detections", + "showLastUpdated": false, + "options": { + "stackMode": "stacked", + "legendDisplay": "off" + } + }, + "viz_mOlKe0Wt": { + "type": "splunk.singlevalue", + "title": "Unique Users with $rmm_id$", + "dataSources": { + "primary": "ds_YUNfIx4j" + }, + "hideWhenNoData": true, + "options": {}, + "context": {}, + "showProgressBar": false, + "showLastUpdated": false, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature IN ($rmm_id|s$)", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ] + }, + "viz_oaVWsWY8": { + "type": "splunk.singlevalue", + "title": "Unique Devices with $rmm_id$", + "dataSources": { + "primary": "ds_aBNX4sbQ" + }, + "hideWhenNoData": true, + "options": {}, + "context": {}, + "showProgressBar": false, + "showLastUpdated": false, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature IN ($rmm_id|s$)", + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$", + "type": "custom", + "newTab": true + } + } + ] + } + }, + "dataSources": { + "ds_archiveSearch": { + "type": "ds.search", + "options": { + "query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count values(src) as src, values(dest) as dest, values(user) as user, values(process_name) as process_name, values(file_name) as file_name, values(url) as url by source,signature,_time", + "queryParameters": { + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$" + } + }, + "name": "ds_rmm_risk_search" + }, + "ds_vqe1IpW4": { + "type": "ds.search", + "options": { + "query": "| tstats summariesonly=true count from datamodel=Risk.All_Risk where source=\"ESCU - Detect Remote Access Software Usage*\" by source \n| `drop_dm_object_name(\"All_Risk\")`", + "queryParameters": { + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$" + } + }, + "name": "ds_alert_search" + }, + "ds_4kVqbyrH": { + "type": "ds.search", + "options": { + "queryParameters": { + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$" + }, + "query": "| inputlookup remote_access_software\n| stats count by description\n| rename description as rmm_software" + }, + "name": "ds_known_rmm_software" + }, + "ds_fbY2wV7Q": { + "type": "ds.search", + "options": { + "queryParameters": { + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$" + }, + "query": "| tstats summariesonly=true count from datamodel=Risk.All_Risk where source = \"ESCU - Detect Remote Access Software Usage*\" by source,_time" + }, + "name": "ds_rmm_risk_tstats_search" + }, + "ds_YTrlswJz": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| timechart sum(count) by signature useother=false limit=20" + }, + "name": "rmm_timechart_by_rmm" + }, + "ds_2OvlCBpy": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| timechart sum(count) as total_rmm" + }, + "name": "rmm_timechart_total" + }, + "ds_LW7LiOhy": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| top limit=20 source,signature" + }, + "name": "rmm_sankey" + }, + "ds_axWH8wT0": { + "type": "ds.chain", + "options": { + "extend": "ds_4kVqbyrH" + }, + "name": "total_rmm_lookup" + }, + "ds_XuRUkYYm": { + "type": "ds.search", + "options": { + "queryParameters": { + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$" + }, + "query": "| inputlookup remote_access_software\n| stats count by description\n| stats count" + }, + "name": "ds_rmm_software_total" + }, + "ds_I4IUb8eZ": { + "type": "ds.search", + "options": { + "queryParameters": { + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$" + }, + "query": "| inputlookup remote_access_software_exceptions\n| stats count" + }, + "name": "ds_rmm_exception_total" + }, + "ds_0ZD3LOc8": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| stats sum(count) as count " + }, + "name": "rmm_total_detections" + }, + "ds_9UEKEzwj": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| stats count by signature\n| stats count" + }, + "name": "rmm_count_by_rmm" + }, + "ds_AdgNL7xF": { + "type": "ds.search", + "options": { + "queryParameters": { + "earliest": "$time_picker.earliest$", + "latest": "$time_picker.latest$" + }, + "query": "index=notable | search orig_source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count" + }, + "name": "total_notable_rmm" + }, + "ds_SDnZFhvW": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\")\n| search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n" + }, + "name": "rmm_full_table_data" + }, + "ds_4jEl4LX9": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| top limit=10 signature\n| eval series=signature \n| chart values(count) over signature by series limit=100 useother=false\n| `sort_chart`\n\n", + "enableSmartSources": true + }, + "name": "rmm_top" + }, + "ds_rh3uALwl_ds_4jEl4LX9": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| rare limit=10 signature\n| eval series=signature \n| chart values(count) over signature by series limit=100 useother=false\n| `sort_chart`\n" + }, + "name": "rmm_rare" + }, + "ds_YUNfIx4j": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\"), user = upper(user)\n| search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n| stats count by user\n| search NOT user IN (\"unknown\",\"*$\")\n| stats count\n| where count > 0" + }, + "name": "rmm_unique_users" + }, + "ds_aBNX4sbQ": { + "type": "ds.chain", + "options": { + "extend": "ds_archiveSearch", + "query": "| eval devices = upper(case(isnotnull(src),src,true(),dest))\n| eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\")\n| search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n| stats dc(devices) as count\n| where count > 0" + }, + "name": "rmm_unique_devices" + } + }, + "inputs": { + "input_AqBjBRiF": { + "type": "input.multiselect", + "options": { + "clearDefaultOnSelection": "TRUE", + "items": ">frame(label, value) | prepend(formattedStatics) | objects()", + "token": "alert_name", + "defaultValue": [ + "*" + ] + }, + "title": "Alert Name", + "context": { + "formattedConfig": { + "number": { + "prefix": "" + } + }, + "formattedStatics": ">statics | formatByType(formattedConfig)", + "statics": [ + [ + "All" + ], + [ + "*" + ] + ], + "label": ">primary | seriesByName(\"source\") | renameSeries(\"label\") | formatByType(formattedConfig)", + "value": ">primary | seriesByName(\"source\") | renameSeries(\"value\") | formatByType(formattedConfig)" + }, + "dataSources": { + "primary": "ds_vqe1IpW4" + } + }, + "input_adFMvLPg": { + "type": "input.multiselect", + "options": { + "clearDefaultOnSelection": "TRUE", + "defaultValue": "*", + "items": ">frame(label, value) | prepend(formattedStatics) | objects()", + "token": "rmm_id" + }, + "title": "RMM Software", + "context": { + "formattedConfig": { + "number": { + "prefix": "" + } + }, + "formattedStatics": ">statics | formatByType(formattedConfig)", + "statics": [ + [ + "All" + ], + [ + "*" + ] + ], + "label": ">primary | seriesByName(\"rmm_software\") | renameSeries(\"label\") | formatByType(formattedConfig)", + "value": ">primary | seriesByName(\"rmm_software\") | renameSeries(\"value\") | formatByType(formattedConfig)" + }, + "dataSources": { + "primary": "ds_4kVqbyrH" + } + }, + "input_ZIvNCkgw": { + "type": "input.timerange", + "options": { + "token": "time_picker", + "defaultValue": "-7d@h,now" + }, + "title": "Time Range" + } + }, + "layout": { + "type": "grid", + "options": { + "height": 1000, + "width": 1440, + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_B31XW5SU", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 287, + "h": 161 + } + }, + { + "item": "viz_total_overtime", + "type": "block", + "position": { + "x": 0, + "y": 161, + "w": 720, + "h": 265 + } + }, + { + "item": "viz_alert_by_host", + "type": "block", + "position": { + "x": 0, + "y": 426, + "w": 476, + "h": 437 + } + }, + { + "item": "viz_mOlKe0Wt", + "type": "block", + "position": { + "x": 0, + "y": 863, + "w": 720, + "h": 140 + } + }, + { + "item": "viz_alert_by_user", + "type": "block", + "position": { + "x": 0, + "y": 1003, + "w": 1440, + "h": 476 + } + }, + { + "item": "viz_5zPh9TFb", + "type": "block", + "position": { + "x": 287, + "y": 0, + "w": 279, + "h": 161 + } + }, + { + "item": "viz_NI1GGlJo", + "type": "block", + "position": { + "x": 476, + "y": 426, + "w": 485, + "h": 437 + } + }, + { + "item": "viz_pmYQoySR", + "type": "block", + "position": { + "x": 566, + "y": 0, + "w": 314, + "h": 161 + } + }, + { + "item": "viz_alert_by_analyst", + "type": "block", + "position": { + "x": 720, + "y": 161, + "w": 720, + "h": 265 + } + }, + { + "item": "viz_oaVWsWY8", + "type": "block", + "position": { + "x": 720, + "y": 863, + "w": 720, + "h": 140 + } + }, + { + "item": "viz_8XkPozlC", + "type": "block", + "position": { + "x": 880, + "y": 0, + "w": 295, + "h": 161 + } + }, + { + "item": "viz_xMCkeXlQ", + "type": "block", + "position": { + "x": 961, + "y": 426, + "w": 479, + "h": 437 + } + }, + { + "item": "viz_wWQo64yc", + "type": "block", + "position": { + "x": 1175, + "y": 0, + "w": 265, + "h": 161 + } + } + ], + "globalInputs": [ + "input_AqBjBRiF", + "input_adFMvLPg", + "input_ZIvNCkgw" + ] + }, + "description": "A dashboard for tracking known remote monitoring and management software.", + "title": "RMM Software Tracking" +} \ No newline at end of file From dbcf31d59ecd0bc025f92353ae45e0235827eefc Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 7 Aug 2024 16:17:43 -0700 Subject: [PATCH 3/4] remove submod --- contentctl | 1 - 1 file changed, 1 deletion(-) delete mode 160000 contentctl diff --git a/contentctl b/contentctl deleted file mode 160000 index 34aa0b12df..0000000000 --- a/contentctl +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 34aa0b12df44c0cc611e66a4549b9b37f3e28417 From db584141867223d58b69e4936d643330b8ce83de Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 19 Aug 2024 13:06:41 +0530 Subject: [PATCH 4/4] updating description and testing --- dashboards/rmm_software_tracking.json | 2 +- dashboards/rmm_software_tracking.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dashboards/rmm_software_tracking.json b/dashboards/rmm_software_tracking.json index b24d80dfc8..9e5cec9f6c 100644 --- a/dashboards/rmm_software_tracking.json +++ b/dashboards/rmm_software_tracking.json @@ -675,6 +675,6 @@ "input_ZIvNCkgw" ] }, - "description": "A dashboard for tracking known remote monitoring and management software.", + "description": "Utilize this dashboard to assist with auditing and monitoring of Remote Monitoring and Management (RMM) alert content.", "title": "RMM Software Tracking" } \ No newline at end of file diff --git a/dashboards/rmm_software_tracking.yml b/dashboards/rmm_software_tracking.yml index 86ed42ee98..417db6c808 100644 --- a/dashboards/rmm_software_tracking.yml +++ b/dashboards/rmm_software_tracking.yml @@ -3,4 +3,4 @@ id: 824b748b-9746-4247-b02b-f0961d6f54a5 version: 1 date: '2024-08-05' author: Steven Dick, Github Community -description: Utilize this dashboard to assist with auditing and monitoring Windows AppLocker events for your endpoints. Configure the applocker macro to use the AppLocker data source for populating the dashboard. \ No newline at end of file +description: Utilize this dashboard to assist with auditing and monitoring of Remote Monitoring and Management (RMM) alert content. \ No newline at end of file