Use the audit dashboards to validate the security and integrity of the data in Enterprise Security. Ensure that forwarders are functioning, that data has not been tampered with and is secured in transmission, and that analysts are reviewing the notable events detected by correlation searches.
Incident Review Audit
The Incident Review Audit dashboard provides an overview of incident review activity. The panels display how many incidents are being reviewed and by which user, along with a list of the most recently reviewed events. The metrics on this dashboard allow security managers to review the activities of analysts.
|Review Activity by Reviewer||Displays the numbers of events reviewed by each user. This panel is useful for determining which user is performing the incident reviews and if the total number of incidents reviewed is changing over time. The drilldown opens a search with all activity by the selected reviewer.|
|Top Reviewers||Displays the top users that have performed incident reviews. The panel includes details for each user, including the date they first performed an incident review, the date they last performed a review, and the total number of incidents reviewed. The drilldown opens a search with all activity by the selected reviewer.|
|Notable Events By Status - Last 48 Hours||Displays the status, count, and urgency for all notable events in the last 48 hours. This panel is useful for determining if the incident review users are keeping up with incidents, or whether a backlog of unreviewed incidents is forming. The drilldown opens the Incident Review dashboard and searches on the selected urgency and status over the lat 48 hours.|
|Notable Events By Owner - Last 48 Hours||Displays the owner, count, and urgency for all notable events in the last 48 hours. This panel is useful for determining how many events are assigned to a user and the urgency of the events. The drilldown opens the Incident Review dashboard and searches on the selected urgency over the lat 48 hours.|
|Mean Time to Triage - Last 14 days||Displays the average time it took for a notable event to be triaged after it was created over the last 14 days, split by the name of the notable event. This panel is useful for determining how quickly analysts are triaging notable events, or whether certain types of events take longer to triage than others. The drilldown opens the Incident Review dashboard and searches on the matching notable event names over the last 14 days.|
|Mean Time to Closure - Last 60 days||Displays the average time it took for a notable event to be closed after it was created over the last 60 days, split by the name of the notable event. This panel is useful for determining how long it takes to close certain types of notable event investigations. The drilldown opens the Incident Review dashboard and searches on the matching notable event names that have a status of closed from the last 60 days.|
|Recent Review Activity||Displays the 10 most recent changes on the incident review dashboard, such as triage actions. The drilldown opens a search with the selected rule ID.|
To audit data from Incident Review from Enterprise Security prior to version 3.2, you must perform an ad hoc search like this example.
index=_audit sourcetype=incident_review | rex field=_raw "^(?<end_time>[^,]*),(?<rule_id>[^,]*),(?<owner>[^,]*),(?<urgency>[^,]*),(?<status>[^,]*),(?<comment>[^,]*),(?<user>[^,]*),(?<rule_name>[^,]*)"
The reports in the Incident Review Audit dashboard reference fields in the notable index and the incident review objects in a KVStore collection. See Notable event index in this manual for more on the notable index.
The Suppression Audit dashboard provides an overview of notable event suppression activity. This dashboard shows how many events are being suppressed, and by whom, so that notable event suppression can be audited and reported on.
The metrics on this dashboard allow security managers to review the activities of analysts, which is useful for tuning correlation searches. You can identify correlation search rules that are generating more events than your analysts are capable of looking at, and tune them accordingly.
|Suppressed Events Over Time - Last 24 Hours||Displays notable events suppressed in the last 24 hours.|
|Suppression History Over Time - Last 30 Days||Displays the history of suppressed notable events.|
|Suppression Management Activity||Displays suppression management activity for the time period.|
|Expired Suppressions||Displays expired suppressions.|
The reports in the Suppression Audit dashboard reference events in the Notable index.
Per-Panel Filter Audit
The Per-Panel Filter Audit dashboard provides information about the filters currently in use in your deployment.
The following table describes the panels for this dashboard.
|Per-Panel By Reviewer||Displays the count of updates to per-panel filters by user|
|Top Users||Shows users, sparkline for trends, number of views, and first and last time viewed.|
|Recent Filter Activity||Activity by time, user, action, and filename|
Adaptive Response Action Center
The Adaptive Response Action Center dashboard provides an overview of the response actions initiated by adaptive response actions, including notable event creation and risk scoring.
|Action Invocations Over Time By Name||Displays a time chart of the adaptive response actions triggered by name.|
|Top Actions By Name||Displays the top adaptive response actions by name.|
|Top Actions By Search||Displays the top adaptive response actions by search.|
|Recent Response Actions||Displays the most recent adaptive response actions.|
The reports in the Adaptive Response Action Center dashboard reference fields in the Audit data model. For a list of data model objects and constraints, see Splunk Audit Logs in the Common Information Model Add-on manual.
Threat Intelligence Audit
The Threat Intelligence Audit dashboard tracks and displays the current status of all threat intelligence sources. As an analyst, you can review this dashboard to determine if threat sources are current, and troubleshoot issues connecting to threat intelligence sources.
|Threat Intelligence Downloads||Displays the status of all threat sources defined on the Threat Intelligence Downloads configuration page. Use the filters to sort by status or download location.|
|Threat Intelligence Audit Events||Displays log events related to threat intelligence downloads configured on the Threat Intelligence Downloads and Threat Intelligence Manager configuration pages. Use the filters to sort and filter the events displayed.|
A system message is automatically created if a threat source download fails.
The reports in the Threat Intelligence Audit dashboard reference events in the
_internal index and state information from the
/services/data/inputs/threatlist REST endpoint.
ES Configuration Health
Use the ES Configuration Health dashboard to compare the latest installed version of Enterprise Security to prior releases and identify configuration anomalies. The dashboard does not report changes to add-ons (TA.) Select the previous version of Enterprise Security installed in your environment using the Previous ES Version filter.
|Unshipped||The Unshipped setting compares the latest installed version of Enterprise Security with the content in the ES installation package. Any item that was not provided as part of the Enterprise Security installation, such as files or scripts used for customization, is labeled as an Unshipped item. Review Unshipped items to evaluate their use, determine if they are still needed, and reconcile if necessary. The Unshipped setting ignores the Previous ES Version filter.|
|Removed Stanzas||The Removed Stanzas setting compares the latest installed version of Enterprise Security with the version that you select in the filter. Removed Stanzas are configuration stanzas that changed between versions, such as a deprecated threat list or input. Review Removed Stanzas to evaluate their use, determine if they are still needed, and reconcile if necessary.|
|Local Overrides||The Local Overrides setting compares the installed version of Enterprise Security with the version that you select in the filter. A setting that conflicts with or overrides the installed version of Enterprise Security is labeled as a Local Override. Review any Local Override settings to evaluate their use, determine if they are still needed, and reconcile if necessary.|
The Content Profile dashboard compares the knowledge objects provided in Enterprise Security to the data models the objects require, and expresses the results as a deployment completeness percentage.
|Deployment Completeness||Displays the percentage of knowledge objects provided in Enterprise Security that reference populated data models. To achieve 100%, each data model referenced by a knowledge object must have data.|
|Unused Data Models||Displays the number of unpopulated data models. If you select Unused Data Models, the Data Model Info view displays only the unpopulated data models.|
|Unused Knowledge Objects||Displays the number of unavailable knowledge objects due to an unpopulated data model.|
|Data Model Info||Displays each of the data models by name. A selection drop down displays a detailed breakdown of the object type and name. For example, selecting the Application_State data model displays over 20 unique searches, and panels by app.|
The reports in the Content Profile dashboard examine the knowledge objects in Enterprise Security and determine which data models they use. If the referenced data model contains events, the knowledge objects are considered available and complete.
The analysis of a knowledge object is limited to the data model name, and does not extend to the data model objects referenced in a knowledge object. Therefore, this dashboard can display 100% completeness and a search or view can still display no data.
To verify there is accelerated data in a data model, use the Data Model Audit dashboard. To verify the data model objects referenced by a dashboard panel, see Dashboard Requirements Matrix in this manual.
Data Model Audit
The Data Model Audit dashboard displays information about the state of data model accelerations in your environment.
|Field Name Panel||Description|
|Top Accelerations By Size||Displays the accelerated data models sorted in descending order by MB on disk|
|Top Accelerations By Run Duration||Displays the accelerated data models sorted in descending order by the time spent on running acceleration tasks.|
|Accelerations Details||Displays a table of the accelerated data models with additional information.|
The reports in the Data Model Audit dashboard reference fields in the Splunk Audit data model. For a list of data model objects and constraints, see Splunk Audit Logs in the Common Information Model Add-on Manual.
The Forwarder Audit dashboard reports on hosts forwarding data to Splunk Enterprise.
Use the search filters and time range selector to focus on groups of forwarders or an individual forwarder.
|Show only expected hosts|| An expected host is a host defined in ES by the expected host field
||Drop-down, select to filter by|
|Host||Filter by the host field in the Asset table.||Text field. Wildcard with an asterisk (*)|
|Business Unit|| Filter by the business unit
||Text field. Wildcard with an asterisk (*)|
|Category||Filter by the category field in the Asset table.||Drop-down, select to filter by|
|Event Count Over Time By Host||Displays the number of events reported over the time period selected in the filter. The events are split by host.|
|Hosts By Last Report Time||Displays a list of hosts, ordered by the last time they reported an event.|
|Splunkd Process Utilization|| Displays the resource utilization of the forwarder's Splunk daemon |
|Splunk Service Start Mode|| Displays the host names that are forwarding events, but are not configured to have |
Relevant data sources for the Forwarder Audit dashboard include data from all forwarders in your Splunk environment and the Application_State data model. See the Common Information Model Add-on Manual for more information. The Common Information Model fields
category are derived by automatic identity lookup, and do not need to be mapped directly.
The Indexing Audit dashboard is designed to help administrators estimate the volume of event data being indexed by Splunk Enterprise. The dashboard displays use EPD (Events Per Day) as a metric to track the event volume per index, and the rate of change in the total event counts per index over time. The EPD applies only to event counts, and is unrelated to the Volume Per Day metric used for licensing.
|Key Indicators||The key indicators on this dashboard are scoped to "All Time," not the "Last 24 hours".|
|Events Per Day Over Time||Displays a column chart representing the event counts per day.|
|Events Per Day||Displays a table representing event counts per day and the average eps.|
|Events Per Index (Last Day)||Displays a table of event counts per index for the last day.|
The reports in the Indexing Audit dashboard reference data generated by the
Audit - Events Per Day - Lookup Gen saved search and are stored within a KVStore collection.
The Search Audit dashboard provides information about the searches being executed in Splunk Enterprise. This dashboard is useful for identifying long running searches, and tracking search activity by user.
|Searches Over Time by Type||Shows the number of searches executed over time by type, such as ad-hoc, scheduled, or real-time. Helps determine whether Splunk's performance is being affected by excessive numbers of searches.|
|Searches Over Time by User|| Shows the number of searches executed by each user. Helps determine when a particular user is executing an excessive number of searches. The |
|Top Searches by Run Time||Lists the most expensive searches in terms of duration. Helps to identify specific searches that may be adversely affecting Splunk performance.|
The reports in the Search Audit dashboard reference scheduled search auditing events from the
The View Audit dashboard reports on the most active views in Enterprise Security. View Audit enables tracking of views that are being accessed on a daily basis and helps to identify any errors triggered when users review dashboard panels.
|View Activity Over Time||Displays the Enterprise Security views that have the greatest access counts over time. The drilldown opens a search view of all page activity for the time selected.|
|Expected View Activity|| Lists the views set up in the Expected View list. You want to review these views on a daily basis for your deployment. Select a dashboard to see details in the Expected View Scorecard panel below.|
Use Configure > Lists and Lookups > Expected Views to set up the Expected View list.
|Web Service Errors||Displays errors that occurred while loading the web interface. Helps identify custom views that contain errors or an underlying issue that need to be escalated to Splunk.|
The reports in the View Audit dashboard reference fields in the Splunk Audit data model. For a list of data model objects and constraints, see Splunk Audit Logs in the Common Information Model Add-on Manual.
The Data Protection dashboard reports on the the status of the data integrity controls.
|Data Integrity Control By Index||Displays a view of all indexes with data protection enabled, sorted by search peer. For more information on configuring and validating data integrity, see Manage data integrity in Securing Splunk Enterprise. If you use Splunk Cloud, file a support case to request enablement of data integrity control.|
|Sensitive Data||Displays the count of events with sensitive data. This panel requires enabling the Personally Identifiable Information Detected correlation search.|
Managing glass tables
Predictive Analytics dashboard
This documentation applies to the following versions of Splunk® Enterprise Security: 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.6.0 Cloud only