Hi,
I am using Splunk App SonicWall Analytics. Sonicwall data is coming to Splunk via IPFIX with extensions.
I am struggling with the Threats v2 dashboard. The main query to find threats is: index=sonicwall tid=257 OR tid=357 OR tid=459 flow_to_virus_id!=0. This query returns events. But the panels of “Threats over time”, “Top Viruses Blocked” and “Where did the Virus come from?” don’t display proper information.
While digging into the Splunk Queries on the dashboard, I noticed that a field virus_name is used in above mentioned panels but there is no existence of such field. I went through the lookups and couldn’t find any mapping between flow_to_virus_id and virus_name.
In addition, I also would like to the mapping between the dest_ip (where did the virus come from) and the real name of the ”from place”.
In summary, what I like to see is the same as Sonicwall threat report:
- How many threats overtime are coming from viruses? And what are they?
- How many threats overtime are coming from Intrusions? And what are they?
- How many threats overtime are coming from spyware? And what are they?
Please help. Thank you very much!
