I want to have some custom dashboards within the infosec app and sort them in a separate dropdown menu. Is there a way to do this?
Yes, just do Save As
and Dashboard Panel
and select the InfoSec_App_for_Splunk
app and it will go into that app.
Yes,
You can modify the /*/splunk/etc/apps/InfoSec_App_for_Splunk/default/data/ui/nav/default.xml
In below example I added an extra menu item called Test Menu Item and a dashboard called test dashboard:
<nav>
<view name="security_posture" default='true' />
<collection label="Continuous Monitoring">
<view name="ids" />
<view name="malware" />
<view name="windows" />
<view name="access" />
<view name="network" />
</collection>
<collection label="Test Menu Item">
<view name="test dashboard"/>
</collection>
<collection label="Advanced Threats">
<view name="access_anomalies" />
<view name="network_anomalies" />
<view name="custom_use_cases" />
</collection>
<view name="security_monitoring" />
<collection label="Investigation">
<view name="user_investigation" />
<view name="asset_investigation" />
</collection>
<view name="compliance"/>
<view name="executive_dashboard"/>
<view name="alerts" />
<view name="infosec_stats"/>
<collection label="Search">
<view name="search" />
<view name="dashboards" />
<collection label="Experimental Dashboards">
<view name="endpoints" />
<view name="cloud_security" />
</collection>
</collection>
<collection label="Help">
<a target="_blank" href="https://splunkbase.splunk.com/app/4240/#/details">Installation Instructions</a>
<view name="using_infosec_app"/>
<view name="resources"/>
<a target="_blank" href="https://answers.splunk.com/answers/ask.html?appid=4240">Ask a Question</a>
</collection>
</nav>
To add another way to the one described by @Azeemering:
You can edit the app menu via GUI if you prefer. Go to the app, then Settings > User Interface (under Knowledge) > Navigation menus > default.
Some additional info on the navigation menus: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEP9