Skip to content

Commit be676e9

Browse files
chchhsiaoDeepSecurityOpenSourceSupport
chchhsiao
authored and
DeepSecurityOpenSourceSupport
committed
Initial version 1.5.2 by Mike Gibson
1 parent 26c2ad4 commit be676e9

22 files changed

+901
-0
lines changed

‎TrendMicroDeepSecurity/README‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
Version 1.5.2: April 4, 2016
2+
- Fixed a typo in the transforms.conf for web reputation events. Credit to Chris Bell for reporting the error.
3+
4+
Version 1.5.1: March 28, 2016
5+
- Fixed an issue with "Intrusion Prevention Rule Updated" events not having their sourcetype modified.
6+
- Fixed an issue where in some cases a space is included immediately after "CEF:" in the syslog output from Deep Security.
7+
- Removed all inputs from the application itself to make it compatible with Splunk Cloud and to follow Splunk best practices of monitoring files.
8+
9+
Version 1.5.0: March 27, 2016
10+
- Added a single UDP input to handle all Deep Security messages (UDP:1514). The sourcetype will be dynamically changed according to the event content.
11+
- Added "Firewall Events by Location" to the "Deep Security Firewall Dashboard" to map the source IP for Firewall events.
12+
- Added "Intrusion Prevention Events by Location" to the "Deep Security Intrusion Prevention Dashboard" to map the source IP for IPS events.
13+
14+
Version 1.4.0: January 2, 2014
15+
- This is the initial release of the Trend Micro Deep Security for Splunk App.

‎TrendMicroDeepSecurity/default/app.conf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#
2+
# Splunk app configuration file
3+
#
4+
5+
[install]
6+
is_configured = 0
7+
install_source_checksum = 0a5c77e19202dea4453e003fdef6c9b47b2086aa
8+
9+
[package]
10+
id = TrendMicroDeepSecurity
11+
12+
[ui]
13+
is_visible = True
14+
label = Trend Micro Deep Security for Splunk
15+
16+
[launcher]
17+
author = Mike Gibson (mike_gibson@trendmicro.com)
18+
description = Trend Micro Deep Security for Splunk
19+
version = 1.5.2

‎TrendMicroDeepSecurity/default/data/ui/nav/default.xml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<nav color="#db3d44">
2+
<view name="flashtimeline" default='true' />
3+
<collection label="Dashboards">
4+
<view name="deepsecurity_antimalware_dashboard" />
5+
<view name="deepsecurity_firewall_dashboard" />
6+
<view name="deepsecurity_ips_dashboard" />
7+
<view name="deepsecurity_integritymonitoring_dashboard" />
8+
<view name="deepsecurity_loginspection_dashboard" />
9+
<view name="deepsecurity_webreputation_dashboard" />
10+
</collection>
11+
<collection label="Saved Searches">
12+
<collection label="Security Events">
13+
<saved source="unclassified" match="Deep Security - High Severity Events"/>
14+
<saved source="unclassified" match="Deep Security - All Security Events" />
15+
<collection label="Module Events">
16+
<saved source="unclassified" match="Deep Security - Anti-Malware Events" />
17+
<saved source="unclassified" match="Deep Security - Firewall Events" />
18+
<saved source="unclassified" match="Deep Security - Intrusion Prevention Events" />
19+
<saved source="unclassified" match="Deep Security - Integrity Monitoring Events" />
20+
<saved source="unclassified" match="Deep Security - Log Inspection Events" />
21+
<saved source="unclassified" match="Deep Security - Web Reputation Events" />
22+
</collection>
23+
</collection>
24+
<collection label="System Events">
25+
<saved source="unclassified" match="Deep Security - System Events" />
26+
</collection>
27+
</collection>
28+
</nav>

‎TrendMicroDeepSecurity/default/data/ui/views/deepsecurity_antimalware_dashboard.xml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<form>
2+
<label>Deep Security Anti-Malware Dashboard</label>
3+
<fieldset submitButton="false">
4+
<input type="time" token="timeframe">
5+
<label>Timeframe</label>
6+
<default>
7+
<earliestTime>-24h@h</earliestTime>
8+
<latestTime>now</latestTime>
9+
</default>
10+
</input>
11+
</fieldset>
12+
<row>
13+
<panel>
14+
<chart>
15+
<title>Anti-Malware Event History</title>
16+
<searchString>sourcetype="deepsecurity-antimalware"| timechart count by act limit=10</searchString>
17+
<earliestTime>$timeframe.earliest$</earliestTime>
18+
<latestTime>$timeframe.latest$</latestTime>
19+
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
20+
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
21+
<option name="charting.axisTitleX.text">Hour</option>
22+
<option name="charting.axisTitleX.visibility">visible</option>
23+
<option name="charting.axisTitleY.text">Events</option>
24+
<option name="charting.axisTitleY.visibility">visible</option>
25+
<option name="charting.axisTitleY2.visibility">visible</option>
26+
<option name="charting.axisX.scale">linear</option>
27+
<option name="charting.axisY.scale">linear</option>
28+
<option name="charting.axisY2.enabled">false</option>
29+
<option name="charting.axisY2.scale">inherit</option>
30+
<option name="charting.chart">column</option>
31+
<option name="charting.chart.nullValueMode">gaps</option>
32+
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
33+
<option name="charting.chart.stackMode">stacked</option>
34+
<option name="charting.chart.style">shiny</option>
35+
<option name="charting.drilldown">all</option>
36+
<option name="charting.layout.splitSeries">0</option>
37+
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
38+
<option name="charting.legend.placement">right</option>
39+
</chart>
40+
</panel>
41+
</row>
42+
<row>
43+
<panel>
44+
<table>
45+
<title>Anti-Malware Status (Computers)</title>
46+
<searchString>sourcetype="deepsecurity-antimalware"| top limit=5 dvchost | rename dvchost as "Computer Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
47+
<earliestTime>$timeframe.earliest$</earliestTime>
48+
<latestTime>$timeframe.latest$</latestTime>
49+
<option name="wrap">true</option>
50+
<option name="rowNumbers">false</option>
51+
<option name="dataOverlayMode">none</option>
52+
<option name="drilldown">cell</option>
53+
<option name="count">10</option>
54+
</table>
55+
</panel>
56+
<panel>
57+
<table>
58+
<title>Anti-Malware Status (Malware)</title>
59+
<searchString>sourcetype="deepsecurity-antimalware"| top limit=5 cef_rulename | rename cef_rulename as "Malware Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
60+
<earliestTime>$timeframe.earliest$</earliestTime>
61+
<latestTime>$timeframe.latest$</latestTime>
62+
<option name="wrap">true</option>
63+
<option name="rowNumbers">false</option>
64+
<option name="dataOverlayMode">none</option>
65+
<option name="drilldown">cell</option>
66+
<option name="count">10</option>
67+
</table>
68+
</panel>
69+
</row>
70+
</form>

‎TrendMicroDeepSecurity/default/data/ui/views/deepsecurity_firewall_dashboard.xml‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
<form>
2+
<label>Deep Security Firewall Dashboard</label>
3+
<fieldset submitButton="false">
4+
<input type="time" token="timeframe">
5+
<label>Time Frame</label>
6+
<default>
7+
<earliestTime>-24h@h</earliestTime>
8+
<latestTime>now</latestTime>
9+
</default>
10+
</input>
11+
</fieldset>
12+
<row>
13+
<panel>
14+
<map>
15+
<title>Firewall Events by Location</title>
16+
<search>
17+
<query>sourcetype=deepsecurity-firewall src!="N/A" | iplocation src | geostats count by src globallimit=0 | sort -count</query>
18+
<earliest>$timeframe.earliest$</earliest>
19+
<latest>$timeframe.latest$</latest>
20+
</search>
21+
<option name="mapping.data.maxClusters">100</option>
22+
<option name="mapping.map.center">(0,0)</option>
23+
<option name="mapping.map.zoom">2</option>
24+
<option name="mapping.markerLayer.markerMaxSize">50</option>
25+
<option name="mapping.markerLayer.markerMinSize">10</option>
26+
<option name="mapping.markerLayer.markerOpacity">0.8</option>
27+
<option name="mapping.tileLayer.maxZoom">7</option>
28+
<option name="mapping.tileLayer.minZoom">0</option>
29+
<option name="drilldown">all</option>
30+
</map>
31+
</panel>
32+
</row>
33+
<row>
34+
<panel>
35+
<chart>
36+
<title>Firewall Event History</title>
37+
<searchString>sourcetype=deepsecurity-firewall | timechart count by act limit=10</searchString>
38+
<earliestTime>$timeframe.earliest$</earliestTime>
39+
<latestTime>$timeframe.latest$</latestTime>
40+
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
41+
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
42+
<option name="charting.axisTitleX.text">Hour</option>
43+
<option name="charting.axisTitleX.visibility">visible</option>
44+
<option name="charting.axisTitleY.text">Events</option>
45+
<option name="charting.axisTitleY.visibility">visible</option>
46+
<option name="charting.axisTitleY2.visibility">visible</option>
47+
<option name="charting.axisX.scale">linear</option>
48+
<option name="charting.axisY.scale">linear</option>
49+
<option name="charting.axisY2.enabled">false</option>
50+
<option name="charting.axisY2.scale">inherit</option>
51+
<option name="charting.chart">column</option>
52+
<option name="charting.chart.nullValueMode">gaps</option>
53+
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
54+
<option name="charting.chart.stackMode">stacked</option>
55+
<option name="charting.chart.style">shiny</option>
56+
<option name="charting.drilldown">all</option>
57+
<option name="charting.layout.splitSeries">0</option>
58+
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
59+
<option name="charting.legend.placement">right</option>
60+
</chart>
61+
</panel>
62+
</row>
63+
<row>
64+
<panel>
65+
<table>
66+
<title>Firewall Activity (Prevented)</title>
67+
<searchString>sourcetype=deepsecurity-firewall act="Deny"| top limit=5 cef_rulename | rename cef_rulename AS "Event Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
68+
<earliestTime>$timeframe.earliest$</earliestTime>
69+
<latestTime>$timeframe.latest$</latestTime>
70+
<option name="wrap">true</option>
71+
<option name="rowNumbers">false</option>
72+
<option name="dataOverlayMode">none</option>
73+
<option name="drilldown">cell</option>
74+
<option name="count">10</option>
75+
</table>
76+
</panel>
77+
<panel>
78+
<table>
79+
<title>Firewall Activity (Detected)</title>
80+
<searchString>sourcetype=deepsecurity-firewall act="IDS:Deny"| top limit=5 cef_rulename | rename cef_rulename AS "Event Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
81+
<earliestTime>$timeframe.earliest$</earliestTime>
82+
<latestTime>$timeframe.latest$</latestTime>
83+
<option name="wrap">true</option>
84+
<option name="rowNumbers">false</option>
85+
<option name="dataOverlayMode">none</option>
86+
<option name="drilldown">cell</option>
87+
<option name="count">10</option>
88+
</table>
89+
</panel>
90+
</row>
91+
<row>
92+
<panel>
93+
<table>
94+
<title>Firewall IP Activity (Prevented)</title>
95+
<searchString>sourcetype=deepsecurity-firewall act="Deny" src!="N/A"| top limit=5 src | rename src AS "Source IP" count AS "Event Count" percent AS "Percent of Total"</searchString>
96+
<earliestTime>$timeframe.earliest$</earliestTime>
97+
<latestTime>$timeframe.latest$</latestTime>
98+
<option name="wrap">true</option>
99+
<option name="rowNumbers">false</option>
100+
<option name="dataOverlayMode">none</option>
101+
<option name="drilldown">cell</option>
102+
<option name="count">10</option>
103+
</table>
104+
</panel>
105+
<panel>
106+
<table>
107+
<title>Firewall IP Activity (Detected)</title>
108+
<searchString>sourcetype=deepsecurity-firewall act="IDS:Deny" src!="N/A"| top limit=5 src | rename src AS "Source IP" count AS "Event Count" percent AS "Percent of Total"</searchString>
109+
<earliestTime>$timeframe.earliest$</earliestTime>
110+
<latestTime>$timeframe.latest$</latestTime>
111+
<option name="wrap">true</option>
112+
<option name="rowNumbers">false</option>
113+
<option name="dataOverlayMode">none</option>
114+
<option name="drilldown">cell</option>
115+
<option name="count">10</option>
116+
</table>
117+
</panel>
118+
</row>
119+
<row>
120+
<panel>
121+
<table>
122+
<title>Firewall Computer Activity (Prevented)</title>
123+
<searchString>sourcetype=deepsecurity-firewall act="Deny" | top limit=5 dvchost | rename dvchost AS "Computer Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
124+
<earliestTime>$timeframe.earliest$</earliestTime>
125+
<latestTime>$timeframe.latest$</latestTime>
126+
<option name="wrap">true</option>
127+
<option name="rowNumbers">false</option>
128+
<option name="dataOverlayMode">none</option>
129+
<option name="drilldown">cell</option>
130+
<option name="count">10</option>
131+
</table>
132+
</panel>
133+
<panel>
134+
<table>
135+
<title>Firewall Computer Activity (Detected)</title>
136+
<searchString>sourcetype=deepsecurity-firewall act="IDS:Deny" | top limit=5 dvchost | rename dvchost AS "Computer Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
137+
<earliestTime>$timeframe.earliest$</earliestTime>
138+
<latestTime>$timeframe.latest$</latestTime>
139+
<option name="wrap">true</option>
140+
<option name="rowNumbers">false</option>
141+
<option name="dataOverlayMode">none</option>
142+
<option name="drilldown">cell</option>
143+
<option name="count">10</option>
144+
</table>
145+
</panel>
146+
</row>
147+
<row>
148+
<panel>
149+
<table>
150+
<title>Firewall Port Activity (Prevented)</title>
151+
<searchString>sourcetype=deepsecurity-firewall act="Deny" dpt &gt; 0 dpt!="N/A"| top limit=5 dpt | rename dpt as "Destination Port" count AS "Event Count" percent AS "Percent of Total"</searchString>
152+
<earliestTime>$timeframe.earliest$</earliestTime>
153+
<latestTime>$timeframe.latest$</latestTime>
154+
<option name="wrap">true</option>
155+
<option name="rowNumbers">false</option>
156+
<option name="dataOverlayMode">none</option>
157+
<option name="drilldown">cell</option>
158+
<option name="count">10</option>
159+
</table>
160+
</panel>
161+
<panel>
162+
<table>
163+
<title>Firewall Port Activity (Detected)</title>
164+
<searchString>sourcetype=deepsecurity-firewall act="IDS:Deny" dpt &gt; 0 dpt!="N/A"| top limit=5 dpt | rename dpt as "Destination Port" count AS "Event Count" percent AS "Percent of Total"</searchString>
165+
<earliestTime>$timeframe.earliest$</earliestTime>
166+
<latestTime>$timeframe.latest$</latestTime>
167+
<option name="wrap">true</option>
168+
<option name="rowNumbers">false</option>
169+
<option name="dataOverlayMode">none</option>
170+
<option name="drilldown">cell</option>
171+
<option name="count">10</option>
172+
</table>
173+
</panel>
174+
</row>
175+
</form>

‎TrendMicroDeepSecurity/default/data/ui/views/deepsecurity_integritymonitoring_dashboard.xml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<form>
2+
<label>Deep Security Integrity Monitoring Dashboard</label>
3+
<fieldset submitButton="false">
4+
<input type="time" token="timeframe">
5+
<label>Time Frame</label>
6+
<default>
7+
<earliestTime>-24h@h</earliestTime>
8+
<latestTime>now</latestTime>
9+
</default>
10+
</input>
11+
</fieldset>
12+
<row>
13+
<panel>
14+
<chart>
15+
<title>Integrity Monitoring Event History</title>
16+
<searchString>sourcetype=deepsecurity-integrity_monitoring | eval severity=case(cef_severity=3, "Low", cef_severity=6, "Medium", cef_severity=8, "High", cef_severity=10, "Critical")| timechart count by severity limit=10</searchString>
17+
<earliestTime>$timeframe.earliest$</earliestTime>
18+
<latestTime>$timeframe.latest$</latestTime>
19+
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
20+
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
21+
<option name="charting.axisTitleX.text">Hour</option>
22+
<option name="charting.axisTitleX.visibility">visible</option>
23+
<option name="charting.axisTitleY.text">Events</option>
24+
<option name="charting.axisTitleY.visibility">visible</option>
25+
<option name="charting.axisTitleY2.visibility">visible</option>
26+
<option name="charting.axisX.scale">linear</option>
27+
<option name="charting.axisY.scale">linear</option>
28+
<option name="charting.axisY2.enabled">false</option>
29+
<option name="charting.axisY2.scale">inherit</option>
30+
<option name="charting.chart">column</option>
31+
<option name="charting.chart.nullValueMode">gaps</option>
32+
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
33+
<option name="charting.chart.stackMode">stacked</option>
34+
<option name="charting.chart.style">shiny</option>
35+
<option name="charting.drilldown">all</option>
36+
<option name="charting.layout.splitSeries">0</option>
37+
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
38+
<option name="charting.legend.placement">right</option>
39+
</chart>
40+
</panel>
41+
</row>
42+
<row>
43+
<panel>
44+
<table>
45+
<title>Integrity Monitoring Activity</title>
46+
<searchString>sourcetype=deepsecurity-integrity_monitoring| top limit=5 cef_rulename | rename cef_rulename AS "Event Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
47+
<earliestTime>$timeframe.earliest$</earliestTime>
48+
<latestTime>$timeframe.latest$</latestTime>
49+
<option name="wrap">true</option>
50+
<option name="rowNumbers">false</option>
51+
<option name="dataOverlayMode">none</option>
52+
<option name="drilldown">cell</option>
53+
<option name="count">10</option>
54+
</table>
55+
</panel>
56+
<panel>
57+
<table>
58+
<title>Integrity Monitoring Computer Activity</title>
59+
<searchString>sourcetype=deepsecurity-integrity_monitoring| top limit=5 dvchost | rename dvchost AS "Computer Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
60+
<earliestTime>$timeframe.earliest$</earliestTime>
61+
<latestTime>$timeframe.latest$</latestTime>
62+
<option name="wrap">true</option>
63+
<option name="rowNumbers">false</option>
64+
<option name="dataOverlayMode">none</option>
65+
<option name="drilldown">cell</option>
66+
<option name="count">10</option>
67+
</table>
68+
</panel>
69+
</row>
70+
</form>

0 commit comments

Comments
 (0)