Work Instructions in SPLUNK

[willadams]

I was looking at apps such as "Splunk Security Essentials" and "ATP Threat hunting" available in SPLUNK base. The apps have a great mechanism that can be user driven by clicking on tiles to open additional information. I was wondering how these are created and whether there any apps available that allows these to be created. My thought is around having a work instruction available in SPLUNK where some one has an event that they need to investigate and instead of going elsewhere be able to reference the information through a panel such as the 2 apps do above.

[Sfry1981]

the best place to start is https://dev.splunk.com/enterprise/ this should get you started on that journey

[iainsmart]

You could create a dashboard with HTML panels for the instruction text. Then using depends/rejects in the SimpleXML for the dashboard and set/unset tokens to show/hide panels depending on what is required by the workflow.

See: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ContextualDrilldown