Security

overall security dashboard

emada
New Member

trying to make a dashboard for overall security in splunk.
here is a few of the searches i have:
Webattacks - index=main "../etc/passwd" OR "union select" OR "javascript:" OR "

Tags (1)
0 Karma

mdessus_splunk
Splunk Employee
Splunk Employee

First, you should use eventtypes for failed login (windows and Unix apps should do that for your) and try to normalize your data (see the CIM standard). This will help you to simplify your queries, make them faster using the datamodel, and when you need a more advanced security solution, will simplify your migration to Enterprise Security.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

They're stored within the app configuration, just like with any other app.

0 Karma

emada
New Member

do you happen to know where to find the queries its using?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You should take a look at the Enterprise Security app: http://apps.splunk.com/app/263/

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...