admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
develop
splunk-security_content/dashboards/rmm_software_tracking.json
T
Bhavin Patel db58414186 updating description and testing
2024-08-19 13:06:41 +05:30

680 lines
25 KiB
JSON
Raw Permalink Blame History

{
"visualizations": {
"viz_total_overtime": {
"type": "splunk.line",
"options": {
"yAxisAbbreviation": "off",
"y2AxisAbbreviation": "off",
"showRoundedY2AxisLabels": false,
"legendTruncation": "ellipsisMiddle",
"showY2MajorGridLines": true,
"xAxisTitleText": "status",
"xAxisTitleVisibility": "show",
"yAxisTitleText": "count",
"yAxisTitleVisibility": "show",
"y2AxisTitleVisibility": "show",
"seriesColorsByField": {},
"legendDisplay": "off",
"nullValueDisplay": "zero"
},
"dataSources": {
"primary": "ds_2OvlCBpy"
},
"eventHandlers": [],
"title": "RMM - Timechart",
"showProgressBar": true,
"description": "Count of total RMM detections in the environment over time ( unapproved / unknown )"
},
"viz_alert_by_analyst": {
"type": "splunk.line",
"dataSources": {
"primary": "ds_YTrlswJz"
},
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature = $name|s$",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
],
"title": "RMM - Timechart by RMM",
"showProgressBar": true,
"description": "Count of unique RMM detections seen in the environment over time ( unapproved / unknown )",
"options": {
"nullValueDisplay": "zero"
}
},
"viz_alert_by_host": {
"type": "splunk.bar",
"dataSources": {
"primary": "ds_4jEl4LX9"
},
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature=$row.signature.value|s$",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
],
"title": "Top RMM Software",
"showProgressBar": true,
"description": "Most frequent RMM Software detections",
"showLastUpdated": false,
"options": {
"legendDisplay": "off",
"stackMode": "stacked"
}
},
"viz_alert_by_user": {
"type": "splunk.table",
"dataSources": {
"primary": "ds_SDnZFhvW"
},
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=$row.source.value|s$ signature=$row.signature.value|s$",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
],
"title": "Risk Detection Events",
"showProgressBar": false,
"showLastUpdated": false,
"hideWhenNoData": true
},
"viz_5zPh9TFb": {
"type": "splunk.singlevalue",
"showProgressBar": false,
"showLastUpdated": false,
"title": "Unique RMM Software Detected",
"description": "Count of unique RMM software seen",
"dataSources": {
"primary": "ds_9UEKEzwj"
},
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count values(src) as src, values(dest) as dest, values(user) as user, values(process_name) as process_name, values(file_name) as file_name, values(url) as url by source,signature,_time \n| stats count by signature\n| sort - count",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
]
},
"viz_B31XW5SU": {
"type": "splunk.singlevalue",
"title": "Monitored RRM Software",
"description": "Total known and monitored RMM software",
"dataSources": {
"primary": "ds_XuRUkYYm"
},
"options": {},
"context": {},
"showProgressBar": false,
"showLastUpdated": false,
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| inputlookup remote_access_software\n| stats values(*) as * by description\n| fields - last_update,isutility,category\n| sort description",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
]
},
"viz_pmYQoySR": {
"type": "splunk.singlevalue",
"title": "Total RMM Software Detections",
"dataSources": {
"primary": "ds_0ZD3LOc8"
},
"showProgressBar": false,
"showLastUpdated": false,
"description": "Total risk detections fired for RMM software",
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
]
},
"viz_wWQo64yc": {
"type": "splunk.singlevalue",
"showProgressBar": false,
"showLastUpdated": false,
"title": "Monitoring Exceptions",
"description": "Total count of exceptions made for RRM software",
"dataSources": {
"primary": "ds_I4IUb8eZ"
},
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| inputlookup remote_access_software_exceptions",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
]
},
"viz_8XkPozlC": {
"type": "splunk.singlevalue",
"title": "Total RMM Software Alerts",
"dataSources": {
"primary": "ds_AdgNL7xF"
},
"showProgressBar": false,
"showLastUpdated": false,
"description": "Total alerts triaged with RMM software detections",
"eventHandlers": [
{
"type": "drilldown.customUrl",
"options": {
"url": "/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=$time_picker.earliest$&latest=$time_picker.latest$&search=%2522ESCU%2520-%2520Detect%2520Remote%2520Access%2520Software%2520Usage*%2522",
"newTab": true
}
}
]
},
"viz_xMCkeXlQ": {
"type": "splunk.sankey",
"dataSources": {
"primary": "ds_LW7LiOhy"
},
"title": "Top Detections to RMM Software",
"description": "RMM Software detection to software affinity"
},
"viz_NI1GGlJo": {
"type": "splunk.bar",
"dataSources": {
"primary": "ds_rh3uALwl_ds_4jEl4LX9"
},
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature=$row.signature.value|s$",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
],
"title": "Rare RMM Software",
"showProgressBar": true,
"description": "Least seen RMM Software detections",
"showLastUpdated": false,
"options": {
"stackMode": "stacked",
"legendDisplay": "off"
}
},
"viz_mOlKe0Wt": {
"type": "splunk.singlevalue",
"title": "Unique Users with $rmm_id$",
"dataSources": {
"primary": "ds_YUNfIx4j"
},
"hideWhenNoData": true,
"options": {},
"context": {},
"showProgressBar": false,
"showLastUpdated": false,
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature IN ($rmm_id|s$)",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
]
},
"viz_oaVWsWY8": {
"type": "splunk.singlevalue",
"title": "Unique Devices with $rmm_id$",
"dataSources": {
"primary": "ds_aBNX4sbQ"
},
"hideWhenNoData": true,
"options": {},
"context": {},
"showProgressBar": false,
"showLastUpdated": false,
"eventHandlers": [
{
"type": "drilldown.linkToSearch",
"options": {
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature IN ($rmm_id|s$)",
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$",
"type": "custom",
"newTab": true
}
}
]
}
},
"dataSources": {
"ds_archiveSearch": {
"type": "ds.search",
"options": {
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count values(src) as src, values(dest) as dest, values(user) as user, values(process_name) as process_name, values(file_name) as file_name, values(url) as url by source,signature,_time",
"queryParameters": {
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$"
}
},
"name": "ds_rmm_risk_search"
},
"ds_vqe1IpW4": {
"type": "ds.search",
"options": {
"query": "| tstats summariesonly=true count from datamodel=Risk.All_Risk where source=\"ESCU - Detect Remote Access Software Usage*\" by source \n| `drop_dm_object_name(\"All_Risk\")`",
"queryParameters": {
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$"
}
},
"name": "ds_alert_search"
},
"ds_4kVqbyrH": {
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$"
},
"query": "| inputlookup remote_access_software\n| stats count by description\n| rename description as rmm_software"
},
"name": "ds_known_rmm_software"
},
"ds_fbY2wV7Q": {
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$"
},
"query": "| tstats summariesonly=true count from datamodel=Risk.All_Risk where source = \"ESCU - Detect Remote Access Software Usage*\" by source,_time"
},
"name": "ds_rmm_risk_tstats_search"
},
"ds_YTrlswJz": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| timechart sum(count) by signature useother=false limit=20"
},
"name": "rmm_timechart_by_rmm"
},
"ds_2OvlCBpy": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| timechart sum(count) as total_rmm"
},
"name": "rmm_timechart_total"
},
"ds_LW7LiOhy": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| top limit=20 source,signature"
},
"name": "rmm_sankey"
},
"ds_axWH8wT0": {
"type": "ds.chain",
"options": {
"extend": "ds_4kVqbyrH"
},
"name": "total_rmm_lookup"
},
"ds_XuRUkYYm": {
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$"
},
"query": "| inputlookup remote_access_software\n| stats count by description\n| stats count"
},
"name": "ds_rmm_software_total"
},
"ds_I4IUb8eZ": {
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$"
},
"query": "| inputlookup remote_access_software_exceptions\n| stats count"
},
"name": "ds_rmm_exception_total"
},
"ds_0ZD3LOc8": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| stats sum(count) as count "
},
"name": "rmm_total_detections"
},
"ds_9UEKEzwj": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| stats count by signature\n| stats count"
},
"name": "rmm_count_by_rmm"
},
"ds_AdgNL7xF": {
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "$time_picker.earliest$",
"latest": "$time_picker.latest$"
},
"query": "index=notable | search orig_source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count"
},
"name": "total_notable_rmm"
},
"ds_SDnZFhvW": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\")\n| search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n"
},
"name": "rmm_full_table_data"
},
"ds_4jEl4LX9": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| top limit=10 signature\n| eval series=signature \n| chart values(count) over signature by series limit=100 useother=false\n| `sort_chart`\n\n",
"enableSmartSources": true
},
"name": "rmm_top"
},
"ds_rh3uALwl_ds_4jEl4LX9": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| rare limit=10 signature\n| eval series=signature \n| chart values(count) over signature by series limit=100 useother=false\n| `sort_chart`\n"
},
"name": "rmm_rare"
},
"ds_YUNfIx4j": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\"), user = upper(user)\n| search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n| stats count by user\n| search NOT user IN (\"unknown\",\"*$\")\n| stats count\n| where count > 0"
},
"name": "rmm_unique_users"
},
"ds_aBNX4sbQ": {
"type": "ds.chain",
"options": {
"extend": "ds_archiveSearch",
"query": "| eval devices = upper(case(isnotnull(src),src,true(),dest))\n| eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\")\n| search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n| stats dc(devices) as count\n| where count > 0"
},
"name": "rmm_unique_devices"
}
},
"inputs": {
"input_AqBjBRiF": {
"type": "input.multiselect",
"options": {
"clearDefaultOnSelection": "TRUE",
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"token": "alert_name",
"defaultValue": [
"*"
]
},
"title": "Alert Name",
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"source\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"source\") | renameSeries(\"value\") | formatByType(formattedConfig)"
},
"dataSources": {
"primary": "ds_vqe1IpW4"
}
},
"input_adFMvLPg": {
"type": "input.multiselect",
"options": {
"clearDefaultOnSelection": "TRUE",
"defaultValue": "*",
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
"token": "rmm_id"
},
"title": "RMM Software",
"context": {
"formattedConfig": {
"number": {
"prefix": ""
}
},
"formattedStatics": ">statics | formatByType(formattedConfig)",
"statics": [
[
"All"
],
[
"*"
]
],
"label": ">primary | seriesByName(\"rmm_software\") | renameSeries(\"label\") | formatByType(formattedConfig)",
"value": ">primary | seriesByName(\"rmm_software\") | renameSeries(\"value\") | formatByType(formattedConfig)"
},
"dataSources": {
"primary": "ds_4kVqbyrH"
}
},
"input_ZIvNCkgw": {
"type": "input.timerange",
"options": {
"token": "time_picker",
"defaultValue": "-7d@h,now"
},
"title": "Time Range"
}
},
"layout": {
"type": "grid",
"options": {
"height": 1000,
"width": 1440,
"gutterSize": 10
},
"structure": [
{
"item": "viz_B31XW5SU",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 287,
"h": 161
}
},
{
"item": "viz_total_overtime",
"type": "block",
"position": {
"x": 0,
"y": 161,
"w": 720,
"h": 265
}
},
{
"item": "viz_alert_by_host",
"type": "block",
"position": {
"x": 0,
"y": 426,
"w": 476,
"h": 437
}
},
{
"item": "viz_mOlKe0Wt",
"type": "block",
"position": {
"x": 0,
"y": 863,
"w": 720,
"h": 140
}
},
{
"item": "viz_alert_by_user",
"type": "block",
"position": {
"x": 0,
"y": 1003,
"w": 1440,
"h": 476
}
},
{
"item": "viz_5zPh9TFb",
"type": "block",
"position": {
"x": 287,
"y": 0,
"w": 279,
"h": 161
}
},
{
"item": "viz_NI1GGlJo",
"type": "block",
"position": {
"x": 476,
"y": 426,
"w": 485,
"h": 437
}
},
{
"item": "viz_pmYQoySR",
"type": "block",
"position": {
"x": 566,
"y": 0,
"w": 314,
"h": 161
}
},
{
"item": "viz_alert_by_analyst",
"type": "block",
"position": {
"x": 720,
"y": 161,
"w": 720,
"h": 265
}
},
{
"item": "viz_oaVWsWY8",
"type": "block",
"position": {
"x": 720,
"y": 863,
"w": 720,
"h": 140
}
},
{
"item": "viz_8XkPozlC",
"type": "block",
"position": {
"x": 880,
"y": 0,
"w": 295,
"h": 161
}
},
{
"item": "viz_xMCkeXlQ",
"type": "block",
"position": {
"x": 961,
"y": 426,
"w": 479,
"h": 437
}
},
{
"item": "viz_wWQo64yc",
"type": "block",
"position": {
"x": 1175,
"y": 0,
"w": 265,
"h": 161
}
}
],
"globalInputs": [
"input_AqBjBRiF",
"input_adFMvLPg",
"input_ZIvNCkgw"
]
},
"description": "Utilize this dashboard to assist with auditing and monitoring of Remote Monitoring and Management (RMM) alert content.",
"title": "RMM Software Tracking"
}
Reference in New Issue View Git Blame Copy Permalink