topic Re: Custom Real-Time Threat Map in Dashboards & Visualizations

Custom Real-Time Threat Map

jillian_caglios — Wed, 11 Feb 2015 16:03:29 GMT

I want to create a custom real-time threat map similar to FireEye's - https://www.fireeye.com/cyber-map/threat-map.html or Norse's - http://map.ipviking.com using the data in Splunk. I have some very simple .js code that uses the Google Maps API and random data to create a similar map. However, I can’t seem to figure out how to run the .js code within Splunk. Furthermore, I can’t use the data from Splunk to populate the map. I would appreciate any suggestions or tips on how to do this in the simplest way possible.

Re: Custom Real-Time Threat Map

LukeMurphey — Wed, 11 Feb 2015 16:47:06 GMT

Splunk has a map built-in that you can use in simpleXML. You can use the geostats command with it to generate the stats in geographical bins and then hand the results to the map for rendering.

Re: Custom Real-Time Threat Map

LukeMurphey — Wed, 11 Feb 2015 16:47:57 GMT

I don't understand this: "I can’t use the data from Splunk to populate the map". Are you saying the data isn't in Splunk?

Re: Custom Real-Time Threat Map

jillian_caglios — Wed, 11 Feb 2015 16:54:10 GMT

LukeMurphey, Thanks you for the reply. I'm aware of this feature, but it doesn't meet our business need. We need to have lines animated from src to dst based on the geostats results. There are 4 types of unrelated lines that will have corresponding colors.

Splunk maps only allows for markers on one location, and it cannot handle the 4 different search results. It can only present the different search results as a pie chart, which would have little meaning. Because of this, I think I am going to have write some custom code to complete the job. If I could just figure out how to run javascript code in Splunk.

Re: Custom Real-Time Threat Map

jillian_caglios — Wed, 11 Feb 2015 16:57:57 GMT

The data is in Splunk and I can find it via the search feature. However, I can't figure out to get the custom code into Splunk, or how to get the search results into the code. Does this clarify things for you?

Re: Custom Real-Time Threat Map

pmloikju — Fri, 14 Aug 2015 13:51:10 GMT

Hi,

Have you achieve your projet ?

Re: Custom Real-Time Threat Map

bk028s — Tue, 19 Jul 2016 21:07:40 GMT

Hi Jillian,

I'm actually working on a very similar problem right now and was wondering if you ever found a solution to your issue?