Custom Real-Time Threat Map

[jillian_caglios]

I want to create a custom real-time threat map similar to FireEye's - https://www.fireeye.com/cyber-map/threat-map.html or Norse's - http://map.ipviking.com using the data in Splunk. I have some very simple .js code that uses the Google Maps API and random data to create a similar map. However, I can’t seem to figure out how to run the .js code within Splunk. Furthermore, I can’t use the data from Splunk to populate the map. I would appreciate any suggestions or tips on how to do this in the simplest way possible.

[LukeMurphey]

I don't understand this: "I can’t use the data from Splunk to populate the map". Are you saying the data isn't in Splunk?

[jillian_caglios]

The data is in Splunk and I can find it via the search feature. However, I can't figure out to get the custom code into Splunk, or how to get the search results into the code. Does this clarify things for you?

[LukeMurphey]

Splunk has a map built-in that you can use in simpleXML. You can use the geostats command with it to generate the stats in geographical bins and then hand the results to the map for rendering.

[jillian_caglios]

LukeMurphey, Thanks you for the reply. I'm aware of this feature, but it doesn't meet our business need. We need to have lines animated from src to dst based on the geostats results. There are 4 types of unrelated lines that will have corresponding colors.

Splunk maps only allows for markers on one location, and it cannot handle the 4 different search results. It can only present the different search results as a pie chart, which would have little meaning. Because of this, I think I am going to have write some custom code to complete the job. If I could just figure out how to run javascript code in Splunk.

[bk028s]

Hi Jillian,

I'm actually working on a very similar problem right now and was wondering if you ever found a solution to your issue?

[pmloikju]

Hi,

Have you achieve your projet ?