admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2024-11-06 13:10:14 -08:00
committed by GitHub
parent 02fd128228 9b6840c0c1
commit 761acd08b4
7 changed files with 1 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app_template/README/essoc_usage_dashboard.txt
-51
View File
@@ -1,51 +0,0 @@
######################
ESSOC Usage Dashboard#
######################
The ESSOC Usage dashboard is designed to provide high-level insight into the usage of the ES-SOC app. It is suitable for display when providing feedback to the Splunk team or for identifying how the ES-SOC app is being used. This dashboard has two time selectors that work independently - the top time selector determines the search time range for all the single-value. And the lower time selector, determines the time range for the usage table.
IMPORTANT: The user loading this dashboard must have permission to search the _audit index
##################
#Dashboard panels#
##################
Searches Ran
The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax
Unique Searches
The unique/distinct searches executed on the deployment. This is equivalent to the distinct count of searches run in the ES-SOC app.
Most Run
The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Ad hoc Searches
The total number of searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Scheduled
The total number of ESSOC searches run that were scheduled.
Most Active User
The user who executed the highest number/count of searches. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Search Run Time (seconds)
Total run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Average Run Time (seconds)
Average run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Max Run Time (seconds)
The run time of the longest running search. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch <ESSOC search_name> ‘ syntax.
Search summary
This table provides details on each search that was executed in the ESSOC app.
app_template/default/analytic_stories.conf
-2
View File
@@ -1,2 +0,0 @@
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
### Using one single file analyticstories.conf that will be used both by ES and ESCU
app_template/default/app.conf
-30
View File
@@ -1,30 +0,0 @@
## Splunk app configuration file
[install]
is_configured = false
state = enabled
state_change_requires_restart = false
build = 16367
[triggers]
reload.analytic_stories = simple
reload.use_case_library = simple
reload.correlationsearches = simple
reload.analyticstories = simple
reload.governance = simple
reload.managed_configurations = simple
reload.postprocess = simple
reload.content-version = simple
reload.es_investigations = simple
[launcher]
author = Splunk
version = 4.9.0
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
is_visible = true
label = ES Content Updates
[package]
id = DA-ESS-ContentUpdate
app_template/default/commands.conf
-11
View File
@@ -1,11 +0,0 @@
# deprecated please see gist: https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1
#[dnstwist]
#filename = dnstwist.py
#chunked = true
# run story functionality has been moved to: https://github.com/splunk/analytic_story_execution'
# [runstory]
# filename = runstory.py
# chunked = true
# is_risky = true
app_template/default/content-version.conf
-2
View File
@@ -1,2 +0,0 @@
[content-version]
version = 4.9.0
app_template/default/use_case_library.conf
-2
View File
@@ -1,2 +0,0 @@
### Deprecated since ESCU UI was deprecated and this conf file is no longer in use
### Using one single file analyticstories.conf that will be used both by ES and ESCU
app_template/metadata/default.meta
+1 -1
View File
@@ -1,6 +1,6 @@
## shared Application-level permissions
[]
access = read : [ * ], write : [ admin ]
access = read : [ * ], write : [ admin, sc_admin ]
export = system
[savedsearches]