mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
459 lines
20 KiB
XML
459 lines
20 KiB
XML
<form script="escu_summary.js">
|
|
<label>Content Library</label>
|
|
<description>Explore the Analytic Stories included with ES Content Updates.</description>
|
|
<!-- Example uses stats transforming command -->
|
|
<!-- This limits evnts passed to post-process search -->
|
|
<title>Content Library</title>
|
|
<search id="baseSS">
|
|
<query>| rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *"</query>
|
|
</search>
|
|
<search id="baseAS">
|
|
<query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0</query>
|
|
</search>
|
|
<row depends="$explore-use-case-es-show$">
|
|
<html>
|
|
<div id="explore-use-case-es-info" />
|
|
</html>
|
|
</row>
|
|
|
|
<init>
|
|
<set token="form.as_cis">*</set>
|
|
<set token="form.as_category">*</set>
|
|
<set token="form.cis_token">*</set>
|
|
<set token="form.searchtype">*</set>
|
|
</init>
|
|
|
|
<row id="tabs">
|
|
<panel>
|
|
<html>
|
|
<ul id="tabs_list" class="nav nav-tabs">
|
|
<li class="active">
|
|
<a href="#" class="toggle-tab es-soc-analytic-story-stats" data-toggle="tab" data-elements="analytic_stories_header_stats,analytic_stories_viz,kill_chain_viz,analytic_stories_details_table">
|
|
Analytic Story Summary
|
|
</a>
|
|
</li>
|
|
<li>
|
|
<a href="#" class="toggle-tab es-soc-search-stats" data-toggle="tab" data-elements="search_stats_header,search_stats_viz,tab_search_type_table">
|
|
Search Summary
|
|
</a>
|
|
</li>
|
|
</ul>
|
|
</html>
|
|
</panel>
|
|
</row>
|
|
|
|
<!-- Rows for Analytic Story Stats -->
|
|
<row id="analytic_stories_header_stats">
|
|
<panel>
|
|
<single>
|
|
<title>Total Analytic Stories</title>
|
|
<search base="baseAS">
|
|
<query>stats count</query>
|
|
</search>
|
|
<!-- post-process search -->
|
|
<option name="colorBy">value</option>
|
|
<option name="colorMode">block</option>
|
|
<option name="drilldown">none</option>
|
|
<option name="numberPrecision">0</option>
|
|
<option name="showSparkline">1</option>
|
|
<option name="showTrendIndicator">1</option>
|
|
<option name="trendColorInterpretation">standard</option>
|
|
<option name="trendDisplayMode">absolute</option>
|
|
<option name="unitPosition">after</option>
|
|
<option name="useColors">1</option>
|
|
<option name="useThousandSeparators">1</option>
|
|
<option name="rangeColors">["0x555","0x65a637"]</option>
|
|
<option name="rangeValues">[0]</option>
|
|
</single>
|
|
</panel>
|
|
<panel>
|
|
<single>
|
|
<title>ESCU App Version</title>
|
|
<search id="version">
|
|
<query>| rest /services/configs/conf-content-version splunk_server=local count=0 | table version</query>
|
|
</search>
|
|
<option name="colorBy">value</option>
|
|
<option name="colorMode">block</option>
|
|
<option name="drilldown">none</option>
|
|
<option name="numberPrecision">0</option>
|
|
<option name="rangeColors">["0x555","0x65a637"]</option>
|
|
<option name="rangeValues">[0]</option>
|
|
<option name="refresh.display">progressbar</option>
|
|
<option name="showSparkline">1</option>
|
|
<option name="showTrendIndicator">1</option>
|
|
<option name="trendColorInterpretation">standard</option>
|
|
<option name="trendDisplayMode">absolute</option>
|
|
<option name="unitPosition">after</option>
|
|
<option name="useColors">1</option>
|
|
<option name="useThousandSeparators">1</option>
|
|
</single>
|
|
</panel>
|
|
</row>
|
|
<row id="analytic_stories_viz">
|
|
<panel>
|
|
<title>
|
|
Story Categories
|
|
</title>
|
|
<chart>
|
|
<search>
|
|
<query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | stats count by category</query>
|
|
</search>
|
|
<drilldown>
|
|
<set token="form.as_category">$click.value$</set>
|
|
<set token="as_category" prefix=""" suffix=""">$click.value$</set>
|
|
</drilldown>
|
|
<option name="charting.chart">bar</option>
|
|
<option name="charting.drilldown">all</option>
|
|
<option name="charting.legend.placement">none</option>
|
|
<option name="charting.axisLabelsX.integerUnits">true</option>
|
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
|
</chart>
|
|
</panel>
|
|
<panel>
|
|
<title>
|
|
Analytic Stories by CIS Critical Security Control
|
|
</title>
|
|
<chart>
|
|
<search>
|
|
<query>
|
|
| rest /services/configs/conf-analytic_stories splunk_server=local count=0
|
|
| spath input=mappings path=cis20{} output="cis"
|
|
| rex field=cis "CIS\s(?<num>\d+)" | stats dc(title) as "Analytic Stories" by num | sort +num
|
|
| rename num as "Critical Security Control"</query>
|
|
</search>
|
|
<drilldown>
|
|
<set token="form.as_cis">$click.value$</set>
|
|
<set token="as_cis">$click.value$</set>
|
|
</drilldown>
|
|
<option name="charting.legend.placement">none</option>
|
|
</chart>
|
|
</panel>
|
|
</row>
|
|
|
|
<row id="kill_chain_viz">
|
|
<panel>
|
|
<title>Kill Chain Phases</title>
|
|
<html>
|
|
<div class="killchain-phases">
|
|
<div class="killchain_card">
|
|
<div class="killchain" style="background-color:#555;">
|
|
<div class="killchain-text" id="reconnaissance">0</div>
|
|
</div>
|
|
<div>
|
|
<p class="killchain-label">Reconnaissance</p>
|
|
</div>
|
|
</div>
|
|
<div class="killchain_card notfirst">
|
|
<div class="killchain" style="background-color:#675551;">
|
|
<div class="killchain-text" id="weaponize">0</div>
|
|
</div>
|
|
<div>
|
|
<p class="killchain-label">Weaponization</p>
|
|
</div>
|
|
</div>
|
|
<div class="killchain_card notfirst">
|
|
<div class="killchain" style="background-color:#78554E;">
|
|
<div class="killchain-text" id="delivery">0</div>
|
|
</div>
|
|
<div>
|
|
<p class="killchain-label">Delivery</p>
|
|
</div>
|
|
</div>
|
|
<div class="killchain_card notfirst">
|
|
<div class="killchain" style="background-color:#8A554B;">
|
|
<div class="killchain-text" id="exploitation">0</div>
|
|
</div>
|
|
<div>
|
|
<p class="killchain-label">Exploitation</p>
|
|
</div>
|
|
</div>
|
|
<div class="killchain_card notfirst">
|
|
<div class="killchain" style="background-color:#9C5647;">
|
|
<div class="killchain-text" id="installation">0</div>
|
|
</div>
|
|
<div>
|
|
<p class="killchain-label">Installation</p>
|
|
</div>
|
|
</div>
|
|
<div class="killchain_card notfirst">
|
|
<div class="killchain" style="background-color:#AD5644;">
|
|
<div class="killchain-text" id="commandandcontrol">0</div>
|
|
</div>
|
|
<div>
|
|
<p class="killchain-label">Command & Control</p>
|
|
</div>
|
|
</div>
|
|
<div class="killchain_card notfirst">
|
|
<div class="killchain" style="background-color:#D6563C;">
|
|
<div class="killchain-text" id="actionsonobjectives">0</div>
|
|
</div>
|
|
<div>
|
|
<p class="killchain-label">Actions on Objectives</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</html>
|
|
</panel>
|
|
</row>
|
|
|
|
<!-- Rows for Analytic Story Table -->
|
|
<row id="analytic_stories_details_table">
|
|
<panel>
|
|
<input type="dropdown" token="as_category">
|
|
<label>Category</label>
|
|
<choice value="*">All</choice>
|
|
<search base="baseAS">
|
|
<latest>now</latest>
|
|
<query>| dedup category | fields category</query>
|
|
</search>
|
|
<fieldForLabel>category</fieldForLabel>
|
|
<fieldForValue>category</fieldForValue>
|
|
<default>*</default>
|
|
<prefix>"</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<input type="dropdown" token="as_kill_chain_phase">
|
|
<label>Kill Chain Phases</label>
|
|
<choice value="*">All</choice>
|
|
<choice value="Reconnaissance">Reconnaissance</choice>
|
|
<choice value="Weaponization">Weaponization</choice>
|
|
<choice value="Delivery">Delivery</choice>
|
|
<choice value="Exploitation">Exploitation</choice>
|
|
<choice value="Installation">Installation</choice>
|
|
<choice value="Command and Control">Command & Control</choice>
|
|
<choice value="Actions on Objectives">Actions on Objectives</choice>
|
|
<prefix>"</prefix>
|
|
<suffix>"</suffix>
|
|
<default>*</default>
|
|
</input>
|
|
<input type="dropdown" token="as_data_models">
|
|
<label>Data Models</label>
|
|
<choice value="*">All</choice>
|
|
<search base="baseAS">
|
|
<latest>now</latest>
|
|
<query>| spath input=data_models path={} output=dm | mvexpand dm | dedup dm | fields dm</query>
|
|
</search>
|
|
<fieldForLabel>dm</fieldForLabel>
|
|
<fieldForValue>dm</fieldForValue>
|
|
<default>*</default>
|
|
<prefix>"</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<input type="dropdown" token="as_cis">
|
|
<label>CIS Critical Security Controls</label>
|
|
<choice value="*">All</choice>
|
|
<search base="baseAS">
|
|
<latest>now</latest>
|
|
<query>
|
|
| spath input=mappings path=cis20{} output=cis
|
|
| rex field=cis "CIS\s(?<num>\d+)"
|
|
| fields num
|
|
| mvexpand num
|
|
| dedup num
|
|
| sort +num
|
|
</query>
|
|
</search>
|
|
<fieldForLabel>num</fieldForLabel>
|
|
<fieldForValue>num</fieldForValue>
|
|
<default>*</default>
|
|
<prefix>"</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<html>
|
|
<input id="analytic_filter_clear" class="btn btn-primary" type="button" value="Clear All"/>
|
|
</html>
|
|
<table>
|
|
<title>Analytic Story Details</title>
|
|
<search base="baseAS">
|
|
<query>
|
|
spath input=data_models path={} output="Data Models"
|
|
| spath input=mappings path=kill_chain_phases{} output="Kill Chain Phases"
|
|
| spath input=mappings path=cis20{} output=cis
|
|
| rex field=cis "CIS\s(?<num>\d+)"
|
|
| rename num as CIS
|
|
| rename title as "Analytic Story" description as "Description" category as "Category" creation_date as "Created" modification_date as "Last Updated"
|
|
| fillnull value="-"
|
|
| search "Data Models"=$as_data_models$
|
|
| search "Kill Chain Phases"=$as_kill_chain_phase$
|
|
| search "Category"=$as_category$
|
|
| search CIS=$as_cis$
|
|
| table "Analytic Story" Description Category "Kill Chain Phases" , CIS, "Data Models" "Created" "Last Updated"</query>
|
|
</search>
|
|
<drilldown>
|
|
<link target="_blank">
|
|
<![CDATA[
|
|
/app/DA-ESS-ContentUpdate/analytic_story_details?hideFilters=true&form.analytic_story_name=$row.Analytic Story$
|
|
]]>
|
|
</link>
|
|
</drilldown>
|
|
<option name="drilldown">row</option>
|
|
<option name="wrap">true</option>
|
|
<option name="rowNumbers">true</option>
|
|
<option name="dataOverlayMode">none</option>
|
|
<option name="count">5</option>
|
|
</table>
|
|
</panel>
|
|
</row>
|
|
<!-- Rows for Search Stats -->
|
|
<row id="search_stats_header">
|
|
<panel>
|
|
<single>
|
|
<title>Total Searches</title>
|
|
<search base="baseSS">
|
|
<query>stats count</query>
|
|
</search>
|
|
<!-- post-process search -->
|
|
<option name="colorBy">value</option>
|
|
<option name="colorMode">block</option>
|
|
<option name="drilldown">none</option>
|
|
<option name="numberPrecision">0</option>
|
|
<option name="showSparkline">1</option>
|
|
<option name="showTrendIndicator">1</option>
|
|
<option name="trendColorInterpretation">standard</option>
|
|
<option name="trendDisplayMode">absolute</option>
|
|
<option name="unitPosition">after</option>
|
|
<option name="useColors">1</option>
|
|
<option name="useThousandSeparators">1</option>
|
|
<option name="rangeColors">["0x555","0x65a637"]</option>
|
|
<option name="rangeValues">[0]</option>
|
|
</single>
|
|
</panel>
|
|
</row>
|
|
<row id="search_stats_viz">
|
|
<panel>
|
|
<title>
|
|
Searches by CIS Critical Security Control
|
|
</title>
|
|
<chart>
|
|
<title></title>
|
|
<search>
|
|
<query>
|
|
| rest /services/saved/searches splunk_server=local count=0
|
|
| search title="ESCU - *" action.escu.search_type=detection
|
|
| spath input=action.escu.analytic_story path={} output=uc | mvexpand uc
|
|
| spath input=action.escu.mappings path=cis20{} output=cis
|
|
| rex field=cis "CIS\s(?<num>\d+)"
|
|
| stats dc(action.escu.full_search_name) AS Searches by num
|
|
| sort +num | rename num AS "Critical Security Control"
|
|
</query>
|
|
<earliest>-24h</earliest>
|
|
<latest>now</latest>
|
|
</search>
|
|
<drilldown>
|
|
<set token="form.cis_token">$click.value$</set>
|
|
<set token="cis_token">$click.value$</set>
|
|
</drilldown>
|
|
</chart>
|
|
</panel>
|
|
<panel>
|
|
<title>
|
|
Search Types
|
|
</title>
|
|
<chart>
|
|
<search>
|
|
<query>
|
|
| rest /services/saved/searches splunk_server=local count=0
|
|
| search title="ESCU - *" | rename action.escu.search_type AS search_type
|
|
| eval search_type = upper(substr(search_type,1,1)) + lower(substr(search_type,2))
|
|
| stats count by search_type
|
|
</query>
|
|
</search>
|
|
<drilldown>
|
|
<set token="searchtype">$click.value$</set>
|
|
<set token="form.searchtype">$click.value$</set>
|
|
</drilldown>
|
|
<option name="charting.chart">bar</option>
|
|
<option name="charting.drilldown">all</option>
|
|
<option name="charting.legend.placement">none</option>
|
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
|
</chart>
|
|
</panel>
|
|
</row>
|
|
<row id="tab_search_type_table">
|
|
<panel>
|
|
<input type="dropdown" token="searchtype">
|
|
<label>Search Type</label>
|
|
<choice value="*">All</choice>
|
|
<choice value="detection">Detection</choice>
|
|
<choice value="investigative">Investigative</choice>
|
|
<choice value="contextual">Contextual</choice>
|
|
<choice value="support">Support</choice>
|
|
<default>$searchtype$</default>
|
|
</input>
|
|
<input type="dropdown" token="kill_chain_phase">
|
|
<label>Kill Chain Phases</label>
|
|
<choice value="*">All</choice>
|
|
<choice value="Reconnaissance">Reconnaissance</choice>
|
|
<choice value="Weaponization">Weaponization</choice>
|
|
<choice value="Delivery">Delivery</choice>
|
|
<choice value="Exploitation">Exploitation</choice>
|
|
<choice value="Installation">Installation</choice>
|
|
<choice value="Command and Control">Command & Control</choice>
|
|
<choice value="Actions on Objectives">Actions on Objectives</choice>
|
|
<prefix>"</prefix>
|
|
<suffix>"</suffix>
|
|
<default>*</default>
|
|
</input>
|
|
|
|
<input type="dropdown" token="data_models">
|
|
<label>Data Models</label>
|
|
<choice value="*">All</choice>
|
|
<search base="baseSS">
|
|
<latest>now</latest>
|
|
<query>| spath input=action.escu.data_models path={} output=dm | dedup dm | fields dm</query>
|
|
</search>
|
|
<fieldForLabel>dm</fieldForLabel>
|
|
<fieldForValue>dm</fieldForValue>
|
|
<default>*</default>
|
|
<prefix>"</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<input type="dropdown" token="cis_token">
|
|
<label>CIS Critical Security Controls</label>
|
|
<choice value="*">All</choice>
|
|
<search base="baseSS">
|
|
<latest>now</latest>
|
|
<query>
|
|
| spath input=action.escu.mappings path=cis20{} output=cis
|
|
| rex field=cis "CIS\s(?<num>\d+)"
|
|
| mvexpand num
|
|
| dedup num
|
|
| sort +num
|
|
| fields num
|
|
</query>
|
|
</search>
|
|
<fieldForLabel>num</fieldForLabel>
|
|
<fieldForValue>num</fieldForValue>
|
|
<default>*</default>
|
|
<prefix>"</prefix>
|
|
<suffix>"</suffix>
|
|
</input>
|
|
<html>
|
|
<input id="search_filter_clear" class="btn btn-primary" type="button" value="Clear All"/>
|
|
</html>
|
|
<table id="type">
|
|
<title>Search Details</title>
|
|
<search base="baseSS">
|
|
<query>
|
|
spath input=action.escu.data_models path={} output="Data Models"
|
|
| spath input=action.escu.mappings path=kill_chain_phases{} output="Kill Chain Phases"
|
|
| spath input=action.escu.mappings path=cis20{} output=cis
|
|
| rex field=cis "CIS\s(?<num>\d+)"
|
|
| rename num as CIS
|
|
| fillnull value="-"
|
|
| search CIS=$cis_token$
|
|
| search "Data Models"=$data_models$
|
|
| search "Kill Chain Phases"=$kill_chain_phase$
|
|
| search action.escu.search_type=$searchtype$
|
|
| rename action.escu.asset_at_risk AS "Asset at Risk" | rename title as "Search Name"| rename modification_date as "Last Updated"
|
|
| table "Search Name" description "Kill Chain Phases" CIS "Data Models" "Last Updated"</query>
|
|
<earliest>0</earliest>
|
|
<latest></latest>
|
|
</search>
|
|
</table>
|
|
</panel>
|
|
</row>
|
|
</form>
|