Splunk Search

InfoSec - Continuous Monitoring - Intrusion Detection Dashboard

AJSCSA
Loves-to-Learn Lots

Would someone be able to help me understand how do to this?  I would like to modify the built in dashboard in the InfoSec APP to exclude a specific source IP address.  The default search the dashboard uses is below.

 

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Intrusion_Detection.IDS_Attacks where * IDS_Attacks.severity="*" by IDS_Attacks.signature, IDS_Attacks.severity | rename "IDS_Attacks.*" as "*" | sort severity

 

Currently, that dashboard visual is full of events from my vulnerability scanner running scans. 

Labels (1)
0 Karma

rcruz
New Member

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Intrusion_Detection.IDS_Attacks where * IDS_Attacks.severity="*" IDS_Attacks.severity="IP TO BE EXCLUDED" by IDS_Attacks.signature, IDS_Attacks.severity | rename "IDS_Attacks.*" as "*" | sort severity

 

Replace the IP TO BE EXCLUDED with the actual IP.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...