Skip to content

Commit 6ebabb8

Browse files
dlamspldlamspl
committed
Added additional widget on main dashboard showing deetections
Update of the app for submit
1 parent 1a637d7 commit 6ebabb8

File tree

9 files changed

+622
-39
lines changed

9 files changed

+622
-39
lines changed

‎appserver/static/docs/attack_range_dashboard_beta.json‎

Lines changed: 464 additions & 0 deletions
Large diffs are not rendered by default.

‎default/app.conf‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,20 @@ install_source_checksum = 45686772837c482f9ef4ffb10fee18da2567dcc7
66

77
[launcher]
88
description = Splunk Attack range dashboards
9-
version = 1.0.2
10-
author = Splunk
9+
version = 1.0.3
10+
author = [email protected]
1111

1212
[ui]
1313
is_visible = 1
1414
label = Attack Range Reporting
1515

16+
[package]
17+
id = splunk_attack_range_reporting
18+
check_for_updates = true
19+
20+
[[email protected]]
21+
email = [email protected]
22+
company = Splunk
23+
24+
[install]
25+
build = 1

‎default/data/ui/views/README‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Add all the views that your app needs in this directory

‎local/data/ui/views/attack_range_main_dashboard.xml‎

Lines changed: 44 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -231,9 +231,31 @@
231231
</row>
232232
<row>
233233
<panel>
234-
<title>Possible Analytic stories</title>
234+
<title>Executed simulations</title>
235+
<table>
236+
<search base="BaseSearch">
237+
<query>|table atomic_test, Hostname,mitre_id,mitre_technique_display,mitre_technique_url,Tactic,Technique,"Test Name", Username
238+
</query>
239+
</search>
240+
<option name="count">5</option>
241+
<option name="dataOverlayMode">none</option>
242+
<option name="drilldown">none</option>
243+
<option name="percentagesRow">false</option>
244+
<option name="rowNumbers">false</option>
245+
<option name="totalsRow">false</option>
246+
<option name="wrap">true</option>
247+
</table>
248+
</panel>
249+
</row>
250+
<row>
251+
<panel>
252+
<title>Potential Analytic stories [$story_count$]</title>
235253
<table>
236254
<search>
255+
256+
<progress>
257+
<set token="story_count">$job.resultCount$</set>
258+
</progress>
237259
<query>`get_attack_data`
238260
| sseidenrichment type=mitreid field=Technique
239261
| eval mitre_id = Technique+" - "+mitre_technique_display, atomic_test= 'Test Number'+"-"+'Test Name'
@@ -281,19 +303,33 @@
281303
</drilldown>
282304
</table>
283305
</panel>
284-
</row>
285-
<row>
286306
<panel>
287-
<title>Executed simulations</title>
307+
<title>Potential detections [$detection_count$]</title>
308+
288309
<table>
289-
<search base="BaseSearch">
290-
<query>
291-
|table atomic_test, Hostname,mitre_id,mitre_technique_display,mitre_technique_url,Tactic,Technique,"Test Name", Username</query>
310+
311+
<search>
312+
<progress>
313+
<set token="detection_count">$job.resultCount$</set>
314+
</progress>
315+
<query>`get_attack_data`
316+
|rename Technique as mitre_technique
317+
318+
| join type=left max=0 mitre_technique
319+
[| sseanalytics
320+
|search mitre_technique!="None"
321+
|mvexpand mitre_technique]
322+
|stats dc(name) by name,mitre_technique,channel
323+
|table name, mitre_technique, channel</query>
324+
<earliest>$time_token.earliest$</earliest>
325+
<latest>$time_token.latest$</latest>
326+
<sampleRatio>1</sampleRatio>
292327
</search>
293-
<option name="count">5</option>
328+
<option name="count">10</option>
294329
<option name="dataOverlayMode">none</option>
295330
<option name="drilldown">none</option>
296331
<option name="percentagesRow">false</option>
332+
<option name="refresh.display">progressbar</option>
297333
<option name="rowNumbers">false</option>
298334
<option name="totalsRow">false</option>
299335
<option name="wrap">true</option>

‎local/data/ui/views/attack_range_navigator.xml‎

Lines changed: 87 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
<form theme="dark">
2+
<init>
3+
<set token="show_init_tactic"></set>
4+
<unset token="show_breakdown_tactic"></unset>
5+
</init>
26
<search id="AtomicRedLookup">
37
<query>|inputlookup atomic-red-windows-tests
48
</query>
@@ -10,7 +14,7 @@
1014
<label>Attack Range Navigator</label>
1115
<description>Available atomic red tests and possible mappings between detections</description>
1216
<fieldset submitButton="false" autoRun="true">
13-
<input type="dropdown" token="channel" searchWhenChanged="true">
17+
<input type="dropdown" token="channel_token" searchWhenChanged="true">
1418
<label>Content Source</label>
1519
<choice value="*">All</choice>
1620
<default>*</default>
@@ -35,6 +39,46 @@
3539
<default>*</default>
3640
<initialValue>*</initialValue>
3741
</input>
42+
<input type="dropdown" token="tactic_name_token" searchWhenChanged="true">
43+
<label>Tactic Name [Detections]</label>
44+
<choice value="*">All</choice>
45+
<default>*</default>
46+
<prefix>"</prefix>
47+
<suffix>"</suffix>
48+
<initialValue>*</initialValue>
49+
<fieldForLabel>Tactic</fieldForLabel>
50+
<fieldForValue>Tactic</fieldForValue>
51+
<change>
52+
<condition match="$tactic_name_token$!=&quot;*&quot; ">
53+
<set token="show_breakdown_tactic"></set>
54+
<unset token="show_init_tactic"></unset>
55+
</condition>
56+
<condition>
57+
<unset token="show_breakdown_tactic"></unset>
58+
<set token="show_init_tactic"></set>
59+
</condition>
60+
</change>
61+
<search>
62+
<query>|inputlookup mitre_matrix_list_ar|dedup Tactic |fields Tactic</query>
63+
<earliest>-24h@h</earliest>
64+
<latest>now</latest>
65+
</search>
66+
</input>
67+
<input type="dropdown" token="technique_name_token" searchWhenChanged="true">
68+
<label>Technique Name [Detections]</label>
69+
<choice value="*">All</choice>
70+
<default>*</default>
71+
<prefix>"*</prefix>
72+
<suffix>*"</suffix>
73+
<initialValue>*</initialValue>
74+
<fieldForLabel>Technique</fieldForLabel>
75+
<fieldForValue>Technique</fieldForValue>
76+
<search>
77+
<query>|inputlookup mitre_matrix_list_ar|dedup Technique |fields Technique</query>
78+
<earliest>-24h@h</earliest>
79+
<latest>now</latest>
80+
</search>
81+
</input>
3882
</fieldset>
3983
<row>
4084
<panel>
@@ -148,6 +192,9 @@
148192
<table>
149193
<title>(Click to view in ESCU)</title>
150194
<search base="AtomicRedLookup">
195+
<progress>
196+
<set token="story_count">$job.resultCount$</set>
197+
</progress>
151198
<query>|rename "Technique #" as Technique
152199
| sseidenrichment type=mitreid field=Technique
153200
| eval mitre_id = Technique+" - "+mitre_technique_display, atomic_test= 'Test Number'+"-"+'Test Name'
@@ -169,9 +216,6 @@
169216
|search Technique=$technique_token$
170217
|stats dc(title) by title
171218
| fields title</query>
172-
<progress>
173-
<set token="story_count">$job.resultCount$</set>
174-
</progress>
175219
</search>
176220
<option name="count">20</option>
177221
<option name="dataOverlayMode">none</option>
@@ -186,24 +230,24 @@
186230
</drilldown>
187231
</table>
188232
</panel>
189-
<panel>
233+
<panel depends="$show_breakdown_tactic$">
190234
<title>Detections with possible Atomic tests mapping [$detection_count$]</title>
191235
<table>
236+
<title>*Tactic Name and Technique Name field applies only here</title>
192237
<search base="SSEAnalytics">
193-
<query>
194-
|mvexpand mitre_technique
238+
<progress>
239+
<set token="detection_count">$job.resultCount$</set>
240+
</progress>
241+
<query>| mvexpand mitre_technique
195242
|search mitre_technique!="None" mitre_technique!="" mitre_technique!="TA*"
196-
|table name , mitre_technique, channel
243+
197244
|lookup atomic-red-windows-tests "Technique #" AS mitre_technique OUTPUT "Test Name" as atomic_test_name
245+
| mvexpand mitre_tactic_display
198246
| eval atomic_test_exists=if(atomic_test_name != "", "1", "0")
247+
| eval "Candidate Atomic test"=mitre_technique
199248
| where atomic_test_exists="1"
200-
|search mitre_technique=$technique_token$
201-
|rename mitre_technique as "Candidate Atomic test"
202-
203-
|table name, "Candidate Atomic test", channel</query>
204-
<progress>
205-
<set token="detection_count">$job.resultCount$</set>
206-
</progress>
249+
|search mitre_technique=$technique_token$ channel=$channel_token$ mitre_tactic_display=$tactic_name_token$ mitre_technique_display=$technique_name_token$
250+
|table name, "Candidate Atomic test", mitre_tactic_display,channel</query>
207251
</search>
208252
<option name="count">10</option>
209253
<option name="dataOverlayMode">none</option>
@@ -214,5 +258,33 @@
214258
<option name="wrap">true</option>
215259
</table>
216260
</panel>
261+
<panel depends="$show_init_tactic$">
262+
<title>Detections with possible Atomic tests mapping [$detection_count_default_panel$]</title>
263+
<table>
264+
<search base="SSEAnalytics">
265+
<progress>
266+
<set token="detection_count_default_panel">$job.resultCount$</set>
267+
</progress>
268+
<query>|mvexpand mitre_technique
269+
|search mitre_technique!="None" mitre_technique!="" mitre_technique!="TA*"
270+
271+
|lookup atomic-red-windows-tests "Technique #" AS mitre_technique OUTPUT "Test Name" as atomic_test_name
272+
| eval atomic_test_exists=if(atomic_test_name != "", "1", "0")
273+
| eval "Candidate Atomic test"=mitre_technique
274+
| where atomic_test_exists="1"
275+
|search mitre_technique="*" channel="*" mitre_technique_display="***"
276+
|search mitre_technique=$technique_token$ channel=$channel_token$ mitre_technique_display=$technique_name_token$
277+
|table name, "Candidate Atomic test",channel</query>
278+
</search>
279+
<option name="count">10</option>
280+
<option name="dataOverlayMode">none</option>
281+
<option name="drilldown">none</option>
282+
<option name="percentagesRow">false</option>
283+
<option name="refresh.display">progressbar</option>
284+
<option name="rowNumbers">false</option>
285+
<option name="totalsRow">false</option>
286+
<option name="wrap">true</option>
287+
</table>
288+
</panel>
217289
</row>
218290
</form>

‎local/transforms.conf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
[mitre_matrix_list_ar]
1+
[atomic-red-windows-tests]
22
batch_index_query = 0
33
case_sensitive_match = 1
4-
filename = mitre_matix_list_ar.csv
4+
filename = windows-atomic-red-tests.csv
55

6-
[atomic-red-windows-tests]
6+
[mitre_matrix_list_ar]
77
batch_index_query = 0
88
case_sensitive_match = 1
9-
filename = windows-atomic-red-tests.csv
9+
filename = mitre_matrix_list_ar.csv

‎metadata/local.meta‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,14 @@ access = read : [ * ]
1111
export = none
1212
owner = admin
1313
version = 8.0.1
14-
modtime = 1587039557.989469000
14+
modtime = 1587537315.709316000
1515

1616
[views/attack_range_navigator]
1717
access = read : [ * ]
1818
export = none
1919
owner = admin
2020
version = 8.0.1
21-
modtime = 1586957534.458117000
21+
modtime = 1587534293.161279000
2222

2323
[nav/default]
2424
version = 8.0.2
@@ -28,19 +28,12 @@ modtime = 1586836655.568709000
2828
version = 8.0.1
2929
modtime = 1586922601.443066000
3030

31-
[lookups/mitre_matix_list_ar.csv]
32-
access = read : [ * ]
33-
export = none
34-
owner = admin
35-
version = 8.0.1
36-
modtime = 1586923458.623613000
37-
3831
[transforms/mitre_matrix_list_ar]
3932
access = read : [ * ]
4033
export = none
4134
owner = admin
4235
version = 8.0.1
43-
modtime = 1586923678.456480000
36+
modtime = 1587406098.533287000
4437

4538
[lookups/windows-atomic-red-tests.csv]
4639
access = read : [ * ]
@@ -62,3 +55,10 @@ export = none
6255
owner = admin
6356
version = 8.0.1
6457
modtime = 1587043563.477440000
58+
59+
[lookups/mitre_matrix_list_ar.csv]
60+
access = read : [ * ]
61+
export = none
62+
owner = admin
63+
version = 8.0.1
64+
modtime = 1587406027.679196000

‎static/screenshot.png‎

340 KB
Loading

‎static/screenshot1.png‎

377 KB
Loading

0 commit comments

Comments
 (0)