All Apps and Add-ons

Find threat details for Dell SonicWALL Analytics App for Splunk

lqiao
Explorer

Hi,

I am using Splunk App SonicWall Analytics. Sonicwall data is coming to Splunk via IPFIX with extensions.

I am struggling with the Threats v2 dashboard. The main query to find threats is: index=sonicwall tid=257 OR tid=357 OR tid=459 flow_to_virus_id!=0. This query returns events. But the panels of “Threats over time”, “Top Viruses Blocked” and “Where did the Virus come from?” don’t display proper information.

While digging into the Splunk Queries on the dashboard, I noticed that a field virus_name is used in above mentioned panels but there is no existence of such field. I went through the lookups and couldn’t find any mapping between flow_to_virus_id and virus_name.

In addition, I also would like to the mapping between the dest_ip (where did the virus come from) and the real name of the ”from place”.

In summary, what I like to see is the same as Sonicwall threat report:
- How many threats overtime are coming from viruses? And what are they?
- How many threats overtime are coming from Intrusions? And what are they?
- How many threats overtime are coming from spyware? And what are they?

Please help. Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...