Splunk® Enterprise Security

Use Splunk Enterprise Security

Download manual as PDF

Download topic as PDF

Key indicators in Splunk Enterprise Security

Splunk Enterprise Security includes predefined key indicators that identify key security metrics for the security domains covered by Splunk Enterprise Security. You can view the key indicators on dashboards in Splunk Enterprise Security, or add them to custom glass tables as security metrics.

Key indicators provide a visual reference for several security metrics. Key indicator searches populate the security metrics of key indicators.The key indicator searches run against the data models defined in Enterprise Security, or the data models defined in the Common Information Model app. Some key indicator searches run against the count of notable events.

Interpreting key indicators on dashboards

On dashboards, each key indicator includes a value indicator, a trend amount, a trend indicator, and a threshold value used to indicate the importance or priority of the indicator. The key indicator searches default to running over a relative time span of 48 hours.

KSI rad with notes.jpg

Field Description
Description Brief description of the security-related metric.
Value indicator Current count of events. If a threshold is set, the numbers will change color as they cross thresholds. Click the value indicator to drill down into the key indicator search and view the raw events. If the value indicator is wrong, such as a percentage value greater than 100%, there could be missing or wrong data in the data model dataset used by the key indicator search to calculate a value.
Trend amount Displays the change in event count over the time period defined in the key indicator search.
Trend indicator Displays a directional arrow to indicate the direction of the trend. The arrow changes color and direction over time.

Edit key indicators on dashboards

Enterprise Security includes preconfigured key indicators. Each dashboard key indicator row includes an editor that allows simple, visual changes to be made directly to the key indicators without leaving the dashboard. You can make changes to the search generating the key indicator on the Content Management dashboard. See Edit a key indicator search in Administer Splunk Enterprise Security.

  1. Click the Edit pencil icon to the top left of the indicator bar. The editing tools display above the indicators.
    KSI rad dash edit.jpg
  2. Drag and drop the indicators to rearrange them. There can be 5 indicators per row, and multiple indicator rows.
  3. Click the checkmark icon to save.

Remove key indicators from a dashboard

Remove a key indicator from a dashboard.

  1. Click the Edit pencil icon to the top left of the indicator bar. The editing tools display above the indicators.
    KSI rad dash edit.jpg
  2. Click the X to the top right of the indicator.
  3. Click the checkmark icon to save.

Removing the indicator from a dashboard does not remove the key indicator from Enterprise Security.

Add key indicators to a dashboard

Add key indicators to a dashboard.

  1. Click the Edit pencil icon to the top left of the indicator bar. The editing tools display above the indicators.
    KSI rad dash edit.jpg
  2. Click the plus icon to open the Add indicators panel.
  3. Click the checkmark icon to save.

Set a threshold for a key indicator on a dashboard

You can set a threshold for a key indicator on a dashboard to change the color of the key indicator. A threshold defines an acceptable value for the event count of an indicator. An event count above the threshold causes the key indicator to display as red, while an event count below the threshold causes the key indicator to display as green. If the threshold is undefined, the event count remains black.

  1. Click the Edit pencil icon to the top left of the indicator bar. The editing tools display above the indicators.
    KSI rad dash edit.jpg
  2. Type a Threshold for the key indicator.
  3. Click the checkmark icon to save.
PREVIOUS
Customize Splunk Enterprise Security dashboards to fit your use case
  NEXT
Security Posture dashboard

This documentation applies to the following versions of Splunk® Enterprise Security: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.7.5, 4.7.6, 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 6.0.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters