SIEM Dashboard

[majilan1]

Hi All,

I'm working hard to create a SIEM dashboard that has the AH list:

higher priority :1)ab 2)CD 3)if 4)GH

rest of the AH:

5)IJ 6)kl 7)MN

for each of these systems, I need a list of hosts associated with the AH and what is currently being ingested from the AH.

[gcusello]

Hi @majilan1,

you should create a lookup containing the perimeter to monitor (called e.g. perimeter.csv) containing at least the host fied and eventually also other information.

Then you coul

| tstats count WHERE index=* BY host
| append [ 
     | inputlookup perimeter.csv
     | eval count=0
     | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Missed","Present")
| table host status

Ciao.

Giuseppe

d run a search like the following

[majilan1]

gcusello,

what I meant to do is using: index=xta then I want to pull fma_id, Org_unify, description, AH tag and the ISO name.

Using fma_id that is pulled from xta example index=*OS-001* and report all index that have that fma_id as part of the string then run a count on all hosts/systems that have the UF installed and register to that fma_id by type (windows vs Linux) then I have to check the available data sets to look for the host in by checking the hosts under fma ID exist in AD, Defender, Big Fix, and Tenable and when they were last detected.

Thanks a lot for your help on this matter.