All Apps and Add-ons

Infosec App for Splunk Dashboard- Malware Dashboard

crizelle
Explorer

Hi,

Will the result on the Malware dashboard also change when we already clean the detected malware?

Thanks!

0 Karma
1 Solution

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @crizelle, the logic here is not specific to the InfoSec app but applies to many other dashboards you see in Splunk:

  • Malware events come into Splunk with time stamps
  • When you look at the Malware dashboard, it displays events in the past 24 hours by default but you can select a different time window (see screenshot below)
  • If your anti-malware tool does not keep reporting on old malware events, the events will not show in the new time window

InfoSec app: Malware dashboard

View solution in original post

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @crizelle, the logic here is not specific to the InfoSec app but applies to many other dashboards you see in Splunk:

  • Malware events come into Splunk with time stamps
  • When you look at the Malware dashboard, it displays events in the past 24 hours by default but you can select a different time window (see screenshot below)
  • If your anti-malware tool does not keep reporting on old malware events, the events will not show in the new time window

InfoSec app: Malware dashboard

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>