Monitor threat activity in your environment with a glass table

In this example, monitor threat activity in your environment by creating a glass table that visualizes and tracks specific threat activity metrics.

• Create a glass table to monitor threat activity.
• Start monitoring threat activity metrics on the glass table.
• Organize the metrics visually.
• Monitor custom metrics on the glass table.
• Save and view the glass table.

Create a glass table to monitor threat activity

1. From the Splunk ES menu bar, click Glass Tables to open the list of existing glass tables.
2. Click Create New Glass Table.
3. Type a Title of Monitor Threat Activity.
4. Type a Description of Monitor threat activity in the network. Displays metrics related to threat notables, threat actors, and types of intelligence.
5. Click Shared in App to allow other users of Splunk Enterprise Security to view the glass table.
6. Click Create Glass Table.
7. Click the title of the glass table to edit it.

Start monitoring threat activity metrics on the glass table

After opening the glass table to edit, collect the relevant threat activity metrics for your glass table.

1. In the list of Security Metrics, click Threat Activity
2. Click the Threat Activity - Total Count metric and drag it onto the glass table.
3. In the Configurations panel, scroll down to Thresholds and select On.
4. Click Edit to set up a threshold.
5. Click Add Threshold and type 50 for a Medium number of total threat activity events.
6. Repeat to add a High threshold of 100 events.
7. Make sure that the threshold below medium is set to Normal.
8. Click Done to save the changes to the threshold.
9. Click Update to save the changes to the security metric.
10. Click and drag the Threat Activity - Unique Categories metric, the Threat Activity - Unique Collections metric, the Threat Activity - Unique Matches metric, and the Threat Activity - Unique Sources metric onto the canvas. Do not set a threshold for the categories, sources, or collections metrics, because a higher number of categories, sources, and collections indicates only that there is more intelligence available to you, rather than a security incident that needs attention.

Organize the metrics visually

Use the editing tools on the glass table canvas to upload images, draw shapes, add icons, add text, and make connections that reflect the relationships between the threat metrics.

1. Click each metric and modify the width and height of each metric to make it the shape you want.
2. Draw lines between the different threat activity metrics to differentiate the types of metrics.
3. If threat activity tracking happens at the router or firewall level, add a router or firewall icon.

Monitor custom metrics on the glass table

Add a custom search to track custom threat activity metrics. You want to track threat activity by a specific threat group, the APT group.

1. In a new tab, open the Search dashboard and construct a search that looks for the APT group. This search relies on the threat list activity correlation search, and identifies notable events over time that contain threat activity from the APT threat group.
   

   `notable("Threat - Threat List Activity - Rule")` | search threat_category="APT" | stats count by threat_category

2. When you are satisfied with your search, copy it to your clipboard.
3. Return to the glass table to add an ad hoc search.
4. In the list of Security Metrics, click Ad hoc search and drag it onto the glass table.
5. In the Configurations editor, type a Label of APT activity for your ad hoc search.
6. Copy your previously-created search that identifies APT activity by threat category in your environment.
   

   `notable("Threat - Threat List Activity - Rule")` | search threat_category="APT" | stats count by threat_category

7. Click Update to save your changes to the ad hoc search metric.

Save and view the glass table

After you finish creating the glass table, you can start monitoring threat activity.

1. Click Save.
2. Click View.

Enjoy the view.