Splunk® Enterprise Security

Use Splunk Enterprise Security

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Key indicators in Splunk Enterprise Security

Splunk Enterprise Security includes predefined key indicators that identify key security metrics for the security domains covered by Splunk Enterprise Security. You can view the key indicators on dashboards in Splunk Enterprise Security.

Key indicators provide a visual reference for several security metrics. Key indicator searches populate the security metrics of key indicators.The key indicator searches run against the data models defined in Enterprise Security, or the data models defined in the Common Information Model app. Some key indicator searches run against the count of notable events.

Interpreting key indicators on dashboards

On dashboards, each key indicator includes a value indicator, a trend amount, a trend indicator, and a threshold value used to indicate the importance or priority of the indicator. The key indicator searches default to running over a relative time span of 48 hours.

Field Description
Description Brief description of the security-related metrics:
Access Notables
The total count and trend of notable events from the Access security domain in incident review. These notable events include titles such as Excessive Failed Logins.
Endpoint Notables
The total count and trend of notable events from the Endpoint security domain in incident review. These notable events include titles such as Host With A Recurring Malware Infection.
Network Notables
The total count and trend of notable events from the Network security domain in incident review. These notable events include titles such as Network Change Detected.
Identity Notables
The total count and trend of notable events from the Identity security domain in incident review. These notable events include titles such as Activity from Expired User Identity.
Audit Notables
The total count and trend of notable events from the Audit security domain in incident review. These notable events include titles such as Personally Identifiable Information Detected.
Threat Notables
The total count and trend of notable events from the Threat security domain in incident review. These notable events include titles such as ATT&CK Tactic Threshold Exceeded For Object Over Previous 7 Days.
UBA Notables
The total count and trend of notable events from filtering on UBA in incident review, if you're sending threat data from Splunk UBA to Splunk Enterprise Security (ES). See Investigate threats from Splunk UBA using Splunk Enterprise Security in the Splunk Add-on for Splunk UBA manual.
Value indicator Current count of events. If a threshold is set, the numbers will change color as they cross thresholds. Click the value indicator to drill down into the key indicator search and view the raw events. If the value indicator is wrong, such as a percentage value greater than 100%, there could be missing or wrong data in the data model dataset used by the key indicator search to calculate a value.
Trend amount Displays the change in event count over the time period defined in the key indicator search.
Trend indicator Displays a directional arrow to indicate the direction of the trend. The arrow changes color and direction over time.

Add key indicators on the dashboards

Splunk Enterprise Security includes preconfigured key indicators on several of its dashboards. From Splunk Enterprise Security version 7.0.1 and higher, you must edit the entire dashboard to add the key indicator values since Dashboard Studio has replaced the classic XML dashboards.

You can also make changes to the search generating the key indicator on the Content Management dashboard. See Edit a key indicator search in Administer Splunk Enterprise Security.

Follow these steps to add a key indicator on a dashboard:

  1. Go to the dashboard that displays key indicator values.
  2. Select the Edit button on the right corner of the dashboard.
  3. Select the key indicator panel on the dashboard to display the editing options for the key indicators on that particular dashboard. Keyindicatoredit.png
    This example displays the editing options available for the User Activity dashboard. In the Group Name, user-activity is selected and reflects the name of the dashboard.
  4. Select the key indicators that you want to add to the dashboard from the list of available key indicators in the Available Key Indicators drop down menu.

    You can add any available key indicator on the dashboard by selecting them from the drop-down menu. There can be 7 indicators in one row, and multiple indicator rows.

  5. Select the Save button to save.

Remove key indicators from a dashboard

Follow these steps to remove a key indicator from a dashboard:

  1. Go to the dashboard that displays key indicator values.
  2. Select the Edit button on the right corner of the dashboard.
  3. Select the key indicator panel on the dashboard to display the editing options for the key indicators on that particular dashboard. Keyindicatoredit.png
    This example displays the editing options available for the User Activity dashboard. In the Group Name, user-activity is selected and reflects the name of the dashboard.
  4. Deselect the key indicators that you want to remove from the dashboard using the list of available key indicators in the Available Key Indicators drop down menu.

    You can remove any available key indicator on the dashboard by deselecting them from the drop-down menu.

  5. Select the Save button to save.

Set a threshold for a key indicator on a dashboard

You can set a threshold for a key indicator on a dashboard to change the color of the key indicator. A threshold defines an acceptable value for the event count of an indicator. An event count above the threshold causes the key indicator to display as red, while an event count below the threshold causes the key indicator to display as green. If the threshold is undefined, the event count remains black.

Follow these steps to set a threshold for a key indicator on a dashboard:

  1. Go to the dashboard that displays key indicator values.
  2. Select the Edit button on the right corner of the dashboard.
  3. Select the key indicator panel on the dashboard to display the editing options for the key indicators on that particular dashboard. Keyindicatoredit.png
    This example displays the editing options available for the User Activity dashboard. In the Group Name, user-activity is selected and reflects the name of the dashboard.
  4. In the Threshold field, enter a value to set the threshold for the key indicator.
  5. Select Save to save your changes.
Last modified on 23 October, 2023
PREVIOUS
Customize Splunk Enterprise Security dashboards to fit your use case
  NEXT
Upgrade to the Splunk Dashboard Framework to improve performance

This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.1, 7.0.2, 7.1.0, 7.1.1, 7.1.2, 7.2.0, 7.3.0, 7.3.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters