Key indicators in Splunk Enterprise Security

Splunk Enterprise Security includes predefined key indicators that identify key security metrics for the security domains covered by Splunk Enterprise Security. You can view the key indicators on dashboards in Splunk Enterprise Security.

Key indicators provide a visual reference for several security metrics. Key indicator searches populate the security metrics of key indicators.The key indicator searches run against the data models defined in Enterprise Security, or the data models defined in the Common Information Model app. Some key indicator searches run against the count of notable events.

Interpreting key indicators on dashboards

On dashboards, each key indicator includes a value indicator, a trend amount, a trend indicator, and a threshold value used to indicate the importance or priority of the indicator. The key indicator searches default to running over a relative time span of 48 hours.

Field	Description
Description	Brief description of the security-related metrics: Access Notables The total count and trend of notable events from the Access security domain in incident review. These notable events include titles such as Excessive Failed Logins. Endpoint Notables The total count and trend of notable events from the Endpoint security domain in incident review. These notable events include titles such as Host With A Recurring Malware Infection. Network Notables The total count and trend of notable events from the Network security domain in incident review. These notable events include titles such as Network Change Detected. Identity Notables The total count and trend of notable events from the Identity security domain in incident review. These notable events include titles such as Activity from Expired User Identity. Audit Notables The total count and trend of notable events from the Audit security domain in incident review. These notable events include titles such as Personally Identifiable Information Detected. Threat Notables The total count and trend of notable events from the Threat security domain in incident review. These notable events include titles such as ATT&CK Tactic Threshold Exceeded For Object Over Previous 7 Days. UBA Notables The total count and trend of notable events from filtering on UBA in incident review, if you're sending threat data from Splunk UBA to Splunk Enterprise Security (ES). See Investigate threats from Splunk UBA using Splunk Enterprise Security in the Splunk Add-on for Splunk UBA manual.
Value indicator	Current count of events. If a threshold is set, the numbers will change color as they cross thresholds. Click the value indicator to drill down into the key indicator search and view the raw events. If the value indicator is wrong, such as a percentage value greater than 100%, there could be missing or wrong data in the data model dataset used by the key indicator search to calculate a value.
Trend amount	Displays the change in event count over the time period defined in the key indicator search.
Trend indicator	Displays a directional arrow to indicate the direction of the trend. The arrow changes color and direction over time.

Add key indicators on the dashboards

Splunk Enterprise Security includes preconfigured key indicators on several of its dashboards. From Splunk Enterprise Security version 7.0.1 and higher, you must edit the entire dashboard to add the key indicator values since Dashboard Studio has replaced the classic XML dashboards.

You can also make changes to the search generating the key indicator on the Content Management dashboard. See Edit a key indicator search in Administer Splunk Enterprise Security.

Follow these steps to add a key indicator on a dashboard:

1. Go to the dashboard that displays key indicator values.
2. Select the Edit button on the right corner of the dashboard.
3. Select the key indicator panel on the dashboard to display the editing options for the key indicators on that particular dashboard.
   This example displays the editing options available for the User Activity dashboard. In the Group Name, user-activity is selected and reflects the name of the dashboard.
4. Select the key indicators that you want to add to the dashboard from the list of available key indicators in the Available Key Indicators drop down menu.

   You can add any available key indicator on the dashboard by selecting them from the drop-down menu. There can be 7 indicators in one row, and multiple indicator rows.

5. Select the Save button to save.

Remove key indicators from a dashboard

Follow these steps to remove a key indicator from a dashboard:

1. Go to the dashboard that displays key indicator values.
2. Select the Edit button on the right corner of the dashboard.
3. Select the key indicator panel on the dashboard to display the editing options for the key indicators on that particular dashboard.
   This example displays the editing options available for the User Activity dashboard. In the Group Name, user-activity is selected and reflects the name of the dashboard.
4. Deselect the key indicators that you want to remove from the dashboard using the list of available key indicators in the Available Key Indicators drop down menu.

   You can remove any available key indicator on the dashboard by deselecting them from the drop-down menu.

5. Select the Save button to save.

Set a threshold for a key indicator on a dashboard

You can set a threshold for a key indicator on a dashboard to change the color of the key indicator. A threshold defines an acceptable value for the event count of an indicator. An event count above the threshold causes the key indicator to display as red, while an event count below the threshold causes the key indicator to display as green. If the threshold is undefined, the event count remains black.

Follow these steps to set a threshold for a key indicator on a dashboard:

1. Go to the dashboard that displays key indicator values.
2. Select the Edit button on the right corner of the dashboard.
3. Select the key indicator panel on the dashboard to display the editing options for the key indicators on that particular dashboard.
   This example displays the editing options available for the User Activity dashboard. In the Group Name, user-activity is selected and reflects the name of the dashboard.
4. In the Threshold field, enter a value to set the threshold for the key indicator.
5. Select Save to save your changes.