Prerequisites to use cloud security dashboards
Using cloud security dashboards, you can onboard cloud data sources and explore your cloud security environment by displaying visualizations of your Amazon Web Services (AWS) and Microsoft 365 environments. To use cloud security dashboards, you must meet the following prerequisites:
If you are currently using the Amazon Web Services (AWS) and Microsoft 365 TAs, you can configure your existing indexes following these steps, instead of creating a new index.
- Create indexes to populate the cloud security dashboards. For more information on creating custom indexes, see Create custom indexes.
- Provide the index name in the Splunk Enterprise Security app settings following these steps:
- From the Splunk Enterprise Security menu, select Configure then General and then General settings.
This displays the configuration settings of Splunk Enterprise Security by applications. - Navigate to AWS Index or Microsoft 365.
The default index value for the AWS Index is:
aws_security
and the default index value for the Microsoft 365 iso365_security
.No indexes exist with the default names. You must create your own indexes to populate the cloud security dashboards and provide the name of the index field for both the AWS Index and the MS 365 Index.
- Populate the index name in the app settings for AWS Index and Microsoft 365 Index.
- From the Splunk Enterprise Security menu, select Configure then General and then General settings.
- Install the Splunk Add-on for Amazon Kinesis Firehose and Splunk Add-on for Microsoft Office 365 from Splunkbase.
- For more information on installing the add-on, see Splunk Add-on for Amazon Kinesis Firehose
- For more information on installing the add-on, see Splunk Add-on for Microsoft Office 365
- Configure the add-ons to send data to the Splunk platform and prepare the Splunk platform to receive the data.
- For more information on configuring Splunk Add-on for Amazon Kinesis Firehose, see Configure Firehose.
- For more information on configuring Splunk Add-on for Microsoft 365, see Configure Microsoft 365
Now you can use the visualizations on the following cloud security dashboards to explore your Amazon Web Services (AWS) and Microsoft 365 environments.
Risk factors turned on by default
The following risk factors are turned on by default:
- The Critical Severity Alert risk factor increases the risk when the alert is critical severity.
- The High Severity Alert risk factor increases the risk when the alert is high severity.
- The Medium Severity Alert risk factor does not increase or decrease the risk when the alert is medium severity.
- The Informational Severity Alert risk factor decreases the risk when the alert is informational severity.
- The Low Severity Alert risk factor decreases the risk when the alert is low severity.
You can modify the calculated score for AWS GuardDuty and Security Hub alert risk events.
See also
Available dashboards in Splunk Enterprise Security | Security posture dashboard |
This documentation applies to the following versions of Splunk® Enterprise Security: 8.0.0
Feedback submitted, thanks!