Alerting

SIEM Dashboard

majilan1
Path Finder

Hi All,

I'm working hard to create a SIEM dashboard that has the AH list:

higher priority :1)ab 2)CD 3)if 4)GH

rest of the AH:

5)IJ 6)kl 7)MN

for each of these systems, I need a list of hosts associated with the AH and what is currently being ingested from the AH.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @majilan1,

you should create a lookup containing the perimeter to monitor (called e.g. perimeter.csv) containing at least the host fied and eventually also other information.

Then you coul

| tstats count WHERE index=* BY host
| append [ 
     | inputlookup perimeter.csv
     | eval count=0
     | fields host count ]
| stats sum(count) AS total BY host
| eval status=if(total=0,"Missed","Present")
| table host status

Ciao.

Giuseppe

d run a search like the following

0 Karma

majilan1
Path Finder

gcusello,

what I meant to do is using: index=xta then I want to pull fma_id, Org_unify, description, AH tag and the ISO name.

Using fma_id that is pulled from xta example index=*OS-001* and report all index that have that fma_id as part of the string then run a count on all hosts/systems that have the UF installed and register to that fma_id by type (windows vs Linux) then I have to check the available data sets to look for the host in by checking the hosts under fma ID exist in AD, Defender, Big Fix, and Tenable and when they were last detected.

Thanks a lot for your help on this matter.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...