Splunk Search

Seeking help to create a dashboard for Antivirus alerts in splunk

Path Finder

Hi community,

Need your help..! is there any possibility that we can create a dashboard for AV related issues or notables...? 

was using the below query but could get the exact results. requesting you to help me on this to create a dashboard for AV related alerts for the servers.

| tstats summariesonly=true max(_time) AS time values(Malware_Attacks.file_name) AS fileName values(Malware_Attacks.signature) AS signature from datamodel=Malware.Malware_Attacks by Malware_Attacks.event_description, Malware_Attacks.dest Malware_Attacks.action | makemv delim="|" fileName
| makemv delim="|" signature
| rename Malware_Attacks.event_description AS event_description
| rename Malware_Attacks.dest AS dest
| rename Malware_Attacks.action as action
| regex event_description!="blocked"
| regex event_description!="deleted"
| regex event_description!="Cleaned"
| regex event_description!="handled"
| where event_description!="Exploit Prevention Files/Process/Registry violation detected" OR threat_handled!=1
| where event_description!="Infected file found, access denied" OR threat_handled!=1
| search action!=handled event_description!=DLL* event_description!="Script security violation detected, AMSI would block"
| table time event_description dest fileName signature




Labels (4)
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...