Knowledge Management

How to generate statistic or visualization results for Splunk Add-on for Symantec DLP?

splunkbeginner
Engager

I have specified the following variables to extract from my Symantec DLP system and send them to Splunk.

Message = ID: $INCIDENT_ID$, Policy Violated: $POLICY$, Rules: $POLICY_RULES$, Count: $MATCH_COUNT$, Protocol: $PROTOCOL$, Recipient: $RECIPIENTS$, Sender: $SENDER$, Severity: $SEVERITY$, Subject: $SUBJECT$, Target: $TARGET$, Filename: $FILE_NAME$, Blocked: $BLOCKED$, Endpoint: $ENDPOINT_MACHINE$

The following are the search results using the “sourcetype=symantec:dlp:syslog”

Feb 21 09:39:11 192.168.1.5 Feb 21 09:40:23 ABCcompany Message = ID: 97712, Policy Violated: IT-IDM-Policy, Rules: [UNKNOWN VARIABLE: POLICY_RULES], Count: 3, Protocol: Endpoint Removable Storage Device, Recipient: N/A, Sender: N/A, Severity: 1:High, Subject: N/A, Target: N/A, Filename: Confidentail2.txt, Blocked: None, Endpoint: PC_David

Feb 21 09:43:48 192.168.1.5 Feb 21 09:46:23 ABCcompany Message = ID: 97713, Policy Violated: IT-IDM-Policy, Rules: [UNKNOWN VARIABLE: POLICY_RULES], Count: 3, Protocol: Endpoint Removable Storage Device, Recipient: N/A, Sender: N/A, Severity: 1:High, Subject: N/A, Target: N/A, Filename: Confidentail.txt, Blocked: None, Endpoint: PC_David

Feb 21 09:43:48 192.168.1.10 Feb 21 09:46:23 ABCcompany Message = ID: 97714, Policy Violated: HR-IDM-Policy, Rules: [UNKNOWN VARIABLE: POLICY_RULES], Count: 3, Protocol: Endpoint HTTPS, Recipient: Unknown, Sender: 192.168.2.122, Severity: 1:High, Subject: N/A, Target: N/A, Filename: N/A, Blocked: None, Endpoint: PC_Ryan

I would like to create a pie chart comparing number (better with percentage) of policies violated; which should be 2 IT-IDM-Policy (66%), and 1 HR-IDM-Policy (33%).
I have extracted a field named “Policy_Violated” by regular expression ^(?:[^:\n]*:){6}\s+(?P[^,]+). And the results are expected as follows:

Values Count %
IT-IDM-Policy 2 66.6
HR-IDM-Policy 1 33.3

But then what search keywords shall be used in order to generate statistic or visualization results which can be used afterwards to create a pie chart?

Tags (1)
0 Karma
1 Solution

pkeenan87
Communicator

Try this search:

sourcetype=symantec:dlp:syslog | stats count by Policy_Violated

Here is a link to all the cool stuff you can do with the stats command: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Stats

I also suggest specifying an index in your search to limit the scope, something like this:

index=<> sourcetype=symantec:dlp:syslog | stats count by Policy_Violated

View solution in original post

0 Karma

pkeenan87
Communicator

Try this search:

sourcetype=symantec:dlp:syslog | stats count by Policy_Violated

Here is a link to all the cool stuff you can do with the stats command: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Stats

I also suggest specifying an index in your search to limit the scope, something like this:

index=<> sourcetype=symantec:dlp:syslog | stats count by Policy_Violated

0 Karma

splunkbeginner
Engager

Thank you pkeenan87. it really helps.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...