admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove ui and app is not visible

Browse Source
This commit is contained in:
bpatel
2021-04-12 13:56:26 -07:00
parent f9efc98f2d
commit e090010a69
4 changed files with 1 additions and 265 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/saaws/default/app.conf
Vendored
+1 -1
View File
@@ -23,7 +23,7 @@ version = 3.18.0
description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content
[ui]
is_visible = true
is_visible = false
label = Splunk Security Analytics for AWS Content
[package]
dist/saaws/default/data/ui/nav/default.xml
Vendored
-6
View File
@@ -1,6 +0,0 @@
<nav search_view="search" color="#65A637">
<view name="escu_summary" default="true"/>
<view name="feedback"/>
<view name="search"/>
<a href="http://docs.splunk.com/Documentation/ESSOC">Docs</a>
</nav>
dist/saaws/default/data/ui/views/escu_summary.xml
Vendored
-244
View File
@@ -1,244 +0,0 @@
<form theme="dark">
<label>Splunk Security Analytics for AWS Content</label>
<!-- Example uses stats transforming command -->
<!-- This limits evnts passed to post-process search -->
<title>Splunk Security Content</title>
<search id="baseSS">
<query>| rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" action.escu.product="*Splunk Security Analytics for AWS*"</query>
</search>
<search id="baseAS">
<query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | search product="*Splunk Security Analytics for AWS*"</query>
</search>
<init>
<set token="form.as_category">*</set>
<set token="form.detection">*</set>
<set token="form.as_story">*</set>
<set token="form.as_attack_id">*</set>
</init>
<!-- Rows for Analytic Story Stats -->
<!-- Rows for Analytic Story Table -->
<!-- Rows for Search Stats -->
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<html>
<h2 style="color:red">Explore the Analytic Stories included with Splunk Security via <a href="https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html">ES Use Case Library</a> or <a href="https://splunkbase.splunk.com/app/3435/">Splunk Security Essentials</a>.</h2>
</html>
</panel>
</row>
<row depends="$explore-use-case-es-show$">
<panel>
<html>
<div id="explore-use-case-es-info"/>
</html>
</panel>
</row>
<row id="analytic_stories_header_stats">
<panel>
<single>
<title>Total Analytic Stories</title>
<search base="baseAS">
<query>stats count</query>
</search>
<!-- post-process search -->
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="rangeColors">["0x555","0x65a637"]</option>
<option name="rangeValues">[0]</option>
</single>
</panel>
<panel>
<single>
<title>Total Detections</title>
<search base="baseSS">
<query>stats count by action.correlationsearch.label| eventstats sum(count) as total_detection_count| fields total_detection_count</query>
</search>
<!-- post-process search -->
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<option name="rangeColors">["0x555","0x65a637"]</option>
<option name="rangeValues">[0]</option>
</single>
</panel>
<panel>
<single>
<title>ESCU App Version</title>
<search id="version">
<query>| rest /services/configs/conf-content-version splunk_server=local count=0 | table version</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x555","0x65a637"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
<row id="analytic_stories_viz">
<panel>
<title>Story Categories</title>
<chart>
<search>
<query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | stats count by category</query>
</search>
<drilldown>
<set token="form.as_category">$click.value$</set>
<set token="as_category" prefix="&quot;" suffix="&quot;">$click.value$</set>
</drilldown>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">all</option>
<option name="charting.legend.placement">none</option>
<option name="charting.axisLabelsX.integerUnits">true</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
</chart>
</panel>
<panel>
<title>Analytic Stories by MITRE Technique ID</title>
<chart>
<search>
<query>
| rest /services/configs/conf-analytic_stories splunk_server=local count=0
| spath input=mappings path=mitre_attack{} output="MITRE Technique ID"
| stats dc(title) as "Analytic Stories" by "MITRE Technique ID"
</query>
</search>
<drilldown>
<set token="form.as_attack_id">$click.value$</set>
<set token="as_attack_id">$click.value$</set>
</drilldown>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
</row>
<row id="analytic_stories_details_table">
<panel>
<input type="dropdown" token="as_story">
<label>Analytic Story</label>
<choice value="*">All</choice>
<search base="baseAS">
<latest>now</latest>
<query>| dedup title | rename title as story | fields story</query>
</search>
<fieldForLabel>story</fieldForLabel>
<fieldForValue>story</fieldForValue>
<default>*</default>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<input type="dropdown" token="detection">
<label>Detections</label>
<choice value="*">All</choice>
<search base="baseSS">
<latest>now</latest>
<query>rename action.correlationsearch.label as Detection | dedup Detection | fields Detection</query>
</search>
<fieldForLabel>Detection</fieldForLabel>
<fieldForValue>Detection</fieldForValue>
<prefix>"</prefix>
<suffix>"</suffix>
<default>*</default>
</input>
<input type="dropdown" token="as_category">
<label>Category</label>
<choice value="*">All</choice>
<search base="baseAS">
<latest>now</latest>
<query>| dedup category | fields category</query>
</search>
<fieldForLabel>category</fieldForLabel>
<fieldForValue>category</fieldForValue>
<default>*</default>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<input type="dropdown" token="as_attack_id">
<label>MITRE Technique ID</label>
<choice value="*">All</choice>
<search base="baseAS">
<latest>now</latest>
<query>| spath input=mappings path=mitre_attack{} output="MITRE Technique ID" | mvexpand "MITRE Technique ID"| dedup "MITRE Technique ID" | fields "MITRE Technique ID"</query>
</search>
<fieldForLabel>MITRE Technique ID</fieldForLabel>
<fieldForValue>MITRE Technique ID</fieldForValue>
<prefix>"</prefix>
<suffix>"</suffix>
<default>*</default>
</input>
<input type="dropdown" token="as_data_models">
<label>Data Models</label>
<choice value="*">All</choice>
<search base="baseAS">
<latest>now</latest>
<query>| spath input=data_models path={} output=dm | mvexpand dm | dedup dm | fields dm</query>
</search>
<fieldForLabel>dm</fieldForLabel>
<fieldForValue>dm</fieldForValue>
<default>*</default>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
<html>
<input id="analytic_filter_clear" class="btn btn-primary" type="button" value="Clear All"/>
</html>
<table>
<title>Analytic Story Details</title>
<search base="baseAS">
<query>
spath input=data_models path={} output="Data Models"
| spath input=mappings path=kill_chain_phases{} output="Kill Chain Phases"
| spath input=detection_searches path={} output="Detections"
| spath input=mappings path=mitre_attack{} output="MITRE Technique ID"
| rename title as "Analytic Story" description as "Description" category as "Category" modification_date as "Last Updated"
| fillnull value="-"
| search "Analytic Story"=$as_story$
| search "Data Models"=$as_data_models$
| search "Category"=$as_category$
| search "MITRE Technique ID"=$as_attack_id$
| search "Detections"=$detection$
| table "Analytic Story", Description, Category, "MITRE Technique ID", "Data Models", Detections, "Last Updated"
</query>
</search>
<drilldown>
<link target="_blank">
<![CDATA[
/app/SplunkEnterpriseSecuritySuite/ess_analytic_story_details?analytic_story=$row.Analytic Story$
]]>
</link>
</drilldown>
<option name="drilldown">row</option>
<option name="wrap">true</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="count">5</option>
</table>
</panel>
</row>
</form>
dist/saaws/default/data/ui/views/feedback.xml
Vendored
-14
View File
@@ -1,14 +0,0 @@
<dashboard isVisible="true">
<label>Feedback Center</label>
<description>Welcome to Splunk Security Analytics for AWS Content Feedback Center.</description>
<row>
<panel>
<html>
<p5>Contact us at <a href="mailto:research@splunk.com">research@splunk.com</a> to send us support requests, bug reports, or questions directly to the Splunk Security Research Team.
<br>Please specify your request type and/or the title of any related Analytic Stories.</br>
You can also find us in the <b>#security-research</b> room in the <a href="http://splunk-usergroups.slack.com/">Splunk Slack channel</a>
</p5>
</html>
</panel>
</row>
</dashboard>