What metrics to monitor for Meltdown and Spectre

[iKickFish]

I realize that these are both hardware vulnerabilities but wanted to know. out of the data we are able to collect with splunk, what specific metrics would be the best to monitor as they directly correlate to Meltdown and Spectre behavior? From what I have been reading from the white papers, it's extremely difficult/ impossible to determine if this attack has been executed in your environment.

Any insight or recommendations are greatly appreciated.

-iKF

[Esky73 · Accepted solution]

depends on what you currently have with Splunk ? are you ingesting from vulnerability management tools ?

If you have Splunk ES you could use that to look for the vunerabilities as per this article here :

https://www.linkedin.com/pulse/splunking-apache-struts-vulnerabilities-exploits-love-ken-westin/

Spectre:

CVE-2017-5753: bounds check bypass

CVE-2017-5715: branch target injection

Meltdown:

CVE-2017-5754: rogue data cache load

So something like ..

tag=vulnerability (cve=" CVE-2017-5753" OR cve=" CVE-2017-5715" OR cve=" CVE-2017-5754")
| table src cve pluginName first_found last_found last_fixed
| dedup src
| fillnull value=NOT_FIXED last_fixed
| search last_fixed=NOT_FIXED
| stats count as total

[iKickFish]

Excellent, Thank you so much!