Skip to content

Commit ea4b2dc

Browse files
ccl0utierccl0utier
committed
Fix links, table headers, add Sankey panel
1 parent a836137 commit ea4b2dc

File tree

2 files changed

+181
-104
lines changed

2 files changed

+181
-104
lines changed

‎default/data/ui/views/attack_range_main_dashboard.xml‎

Lines changed: 109 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@
22
<search id="BaseSearch">
33
<query>`get_attack_data`
44
|lookup enterprise-attack-lookup Technique
5-
| eval mitre_id = Technique+" - "+mitre_technique_display, atomic_test= 'Test Number'+"-"+'Test Name'
6-
| table atomic_test, Hostname,mitre_id,mitre_technique_display,mitre_technique_url,Tactic,Technique,"Test Name", Username
5+
| eval mitre_id = Technique + " - " + mitre_technique_display, atomic_test = 'Test Number' + "-" + 'Test Name'
6+
| sort -_time
7+
| table atomic_test, Hostname, mitre_id, mitre_technique_display, mitre_technique_url, Tactic, Technique, "Test Name", Username
78
</query>
89
<earliest>$time_token.earliest$</earliest>
910
<latest>$time_token.latest$</latest>
@@ -14,17 +15,34 @@
1415
| rest /services/apps/local
1516
| where title = "SplunkEnterpriseSecuritySuite"
1617
</query>
17-
<finalized >
18+
<finalized>
1819
<condition match=" 'job.resultCount' != 0">
19-
<set token="filterESLink">noop</set>
20-
</condition>
21-
<condition>
22-
<set token="filterESLink">rename view_es as _view_es</set>
23-
</condition>
24-
</finalized >
20+
<set token="filterESLink">noop</set>
21+
</condition>
22+
<condition>
23+
<set token="filterESLink">rename view_es as _view_es</set>
24+
</condition>
25+
</finalized>
26+
</search>
27+
<!-- Check if the SanKey Visualiztion is installed, and inform the user if not (and adapt the relevant panel content accordingly) -->
28+
<search id="SanskeyInstalledSearch">
29+
<query>
30+
| rest /services/apps/local
31+
| where title = "sankey_diagram_app"
32+
</query>
33+
<finalized>
34+
<condition match=" 'job.resultCount' != 0">
35+
<set token="SanskeyInstalled">1</set>
36+
<unset token="SanskeyNotInstalled"></unset>
37+
</condition>
38+
<condition>
39+
<unset token="SanskeyInstalled"></unset>
40+
<set token="SanskeyNotInstalled">1</set>
41+
</condition>
42+
</finalized>
2543
</search>
2644
<label>Attack Range Dashboard</label>
27-
<description>Shows tests already run and relevant statistics in addition to possible analytic stories for executed tests. Currently supports only Atomic Red tests</description>
45+
<description>Shows tests already run and relevant statistics in addition to possible Analytic Stories/Detections that might be used to detect executed tests. Currently supports only Atomic Red tests.</description>
2846
<fieldset submitButton="false">
2947
<input type="time" token="time_token" searchWhenChanged="true">
3048
<label>Time range</label>
@@ -39,7 +57,7 @@
3957
<title># Simulations run</title>
4058
<viz type="status_indicator_app.status_indicator">
4159
<search base="BaseSearch">
42-
<query>|stats count</query>
60+
<query>| stats count</query>
4361
</search>
4462
<option name="status_indicator_app.status_indicator.colorBy">static_color</option>
4563
<option name="status_indicator_app.status_indicator.fillTarget">text</option>
@@ -57,7 +75,7 @@
5775
<title># MITRE ATT&amp;CK Tactics</title>
5876
<viz type="status_indicator_app.status_indicator">
5977
<search base="BaseSearch">
60-
<query>|stats dc(Tactic)</query>
78+
<query>| stats dc(Tactic)</query>
6179
</search>
6280
<option name="drilldown">none</option>
6381
<option name="refresh.display">progressbar</option>
@@ -80,7 +98,7 @@
8098
<title># MITRE ATT&amp;CK Techniques</title>
8199
<viz type="status_indicator_app.status_indicator">
82100
<search base="BaseSearch">
83-
<query>|stats dc(Technique)</query>
101+
<query>| stats dc(Technique)</query>
84102
</search>
85103
<option name="drilldown">none</option>
86104
<option name="refresh.display">progressbar</option>
@@ -105,7 +123,7 @@
105123
<title>Attack username</title>
106124
<chart>
107125
<search base="BaseSearch">
108-
<query>|stats count by Username</query>
126+
<query>| stats count by Username</query>
109127
</search>
110128
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
111129
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
@@ -145,7 +163,7 @@
145163
<title>Target hosts</title>
146164
<chart>
147165
<search base="BaseSearch">
148-
<query>|stats count by Hostname</query>
166+
<query>| stats count by Hostname</query>
149167
</search>
150168
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
151169
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
@@ -187,7 +205,7 @@
187205
<title>Tactics simulated</title>
188206
<chart>
189207
<search base="BaseSearch">
190-
<query>|stats count by Tactic</query>
208+
<query>| stats count by Tactic</query>
191209
</search>
192210
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
193211
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
@@ -244,12 +262,50 @@
244262
</viz>
245263
</panel>
246264
</row>
265+
<row>
266+
<panel depends="$SanskeyInstalled$">
267+
<title>Executed Simulations [$simulation_count$]</title>
268+
<viz type="sankey_diagram_app.sankey_diagram">
269+
<search>
270+
<progress>
271+
<set token="simulation_count">$job.resultCount$</set>
272+
</progress>
273+
<query>`get_attack_data`
274+
| lookup enterprise-attack-lookup Technique
275+
| eval Label = Tactic + " - " + mitre_tactic_display
276+
| eval Label2 = Technique + " - " + mitre_technique_display
277+
| stats count by Label2, Label
278+
| table Label, Label2, count
279+
| rename Label as step1, Label2 as step2
280+
| append [
281+
search `get_attack_data`
282+
| lookup enterprise-attack-lookup Technique
283+
| eval Label = Technique + " - " + mitre_technique_display
284+
| eventstats dc("Test Name") as count by Label, Tactic, "Test Name"
285+
| table Label, "Test Name", count
286+
| rename Label as step1, "Test Name" as step2
287+
]</query>
288+
<earliest>$time_token.earliest$</earliest>
289+
<latest>$time_token.latest$</latest>
290+
</search>
291+
<option name="drilldown">none</option>
292+
</viz>
293+
</panel>
294+
<panel depends="$SanskeyNotInstalled$">
295+
<html>
296+
<p>In order for this panel to show properly, please install the SanKey visualization available <a href="https://splunkbase.splunk.com/app/3112/">here</a></p>
297+
</html>
298+
</panel>
299+
</row>
247300
<row>
248301
<panel>
249-
<title>Executed simulations</title>
302+
<title>Executed Simulations [$simulation_count$] - Details</title>
250303
<table>
251304
<search base="BaseSearch">
252-
<query>|table atomic_test, Hostname,mitre_id,mitre_technique_display,mitre_technique_url,Tactic,Technique,"Test Name", Username
305+
<progress>
306+
<set token="simulation_count">$job.resultCount$</set>
307+
</progress>
308+
<query>| rename atomic_test as "Atomic Red Test", mitre_id as "MITRE ID", mitre_technique_display as "Name", mitre_technique_url as "Technique URL", Username as "User Name"
253309
</query>
254310
</search>
255311
<option name="count">5</option>
@@ -275,29 +331,29 @@
275331
and also normalizes the field for other fringe cases (duplicate spaces, extra spaces at the end, etc.) -->
276332
<query>`get_attack_data`
277333
| lookup enterprise-attack-lookup Technique
278-
| eval mitre_id = Technique+" - "+mitre_technique_display, atomic_test= 'Test Number'+"-"+'Test Name'
279-
280-
| join type=left max=0 Technique
281-
[
282-
| rest /services/configs/conf-analytic_stories splunk_server=local count=0
283-
| rex field=mappings ".*,+\s\"mitre_attack\":(?&lt;technique&gt;.*),+\s\"nist\""
284-
| rex field=technique mode=sed "s/\[//g"
285-
| rex field=technique mode=sed "s/\]//g"
286-
| eval technique=split(technique, ",")
287-
| rex field=technique mode=sed "s/\"//g"
288-
| mvexpand technique
289-
| eval Technique=trim(technique)
290-
| where Technique!=""
291-
| fields Technique, title
292-
]
334+
| rename Technique as mitre_attack
335+
| stats count by mitre_attack
336+
| fields mitre_attack
337+
| join mitre_attack max=0 [
338+
| rest /services/configs/conf-savedsearches splunk_server=local count=0
339+
| search action.escu.search_type = detection
340+
| spath input=action.correlationsearch.annotations path=analytic_story{} output="analytic_story"
341+
| spath input=action.correlationsearch.annotations path=mitre_attack{} output="mitre_attack"
342+
| fields analytic_story, mitre_attack, title
343+
| mvexpand mitre_attack
344+
| search mitre_attack!=""
345+
| stats dc(title) as detections by analytic_story, mitre_attack
346+
]
293347
| eval view_es="View [ES]"
294348
| eval view_sse="View [SSE]"
295349
| eval view_docs="View [Docs]"
296350
| eval execute="Execute [ASX]"
351+
| rename analytic_story as title
297352
| eval _docs_title = trim(replace(title, "\s+", " "))
298-
| eval _docs_title = upper(substr(mvjoin(split(lower(_docs_title), " "), "_"),1,1)).substr(mvjoin(split(lower(_docs_title), " "), "_"), 2)
299-
| stats dc(title) by title, _docs_title, view_es, view_docs, execute
300-
| fields title, _docs_title, view_es, view_docs, execute
353+
| eval _docs_title = lower(substr(mvjoin(split(lower(_docs_title), " "), "_"),1,1)).substr(mvjoin(split(lower(_docs_title), " "), "_"), 2)
354+
| fields title, mitre_attack, detections, _docs_title, view_es, view_docs, execute
355+
| eval _title = title
356+
| rename title as "Analytic Story", mitre_attack as "Att&amp;ck Technique", detections as "Detections", view_es as "ES Link", view_docs as "Docs Link", execute as "Run in ASX"
301357
| $filterESLink$
302358
</query>
303359
<earliest>$time_token.earliest$</earliest>
@@ -313,21 +369,21 @@
313369
<option name="totalsRow">false</option>
314370
<option name="wrap">true</option>
315371
<drilldown>
316-
<condition field="view_es">
372+
<condition field="ES Link">
317373
<link target="_blank">/app/SplunkEnterpriseSecuritySuite/ess_analytic_story_details?analytic_story=$click.value$</link>
318374
</condition>
319-
<!--<condition field="view_sse">
375+
<!--<condition field="SSE Link">
320376
<link target="_blank">/app/Splunk_Security_Essentials/TBD?=$click.value$</link>
321377
</condition>-->
322-
<condition field="view_docs">
323-
<link target="_blank">https://docs.splunk.com/Documentation/ESSOC/latest/stories/UseCase#$row._docs_title$</link>
378+
<condition field="Docs Link">
379+
<link target="_blank">https://research.splunk.com/stories/$row._docs_title$</link>
324380
</condition>
325381
<!-- Default link is the documentation -->
326-
<condition field="title">
327-
<link target="_blank">https://docs.splunk.com/Documentation/ESSOC/latest/stories/UseCase#$row._docs_title$</link>
382+
<condition field="Analytic Story">
383+
<link target="_blank">https://research.splunk.com/stories/$row._docs_title$</link>
328384
</condition>
329-
<condition field="execute">
330-
<link target="_blank">/app/Splunk_ASX/execute?form.mode=now&amp;form.time.earliest=-24h@h&amp;form.time.latest=now&amp;form.story=$row.title$</link>
385+
<condition field="Run in ASX">
386+
<link target="_blank">/app/Splunk_ASX/execute?form.mode=now&amp;form.time.earliest=-24h@h&amp;form.time.latest=now&amp;form.story=$row._title$</link>
331387
</condition>
332388
</drilldown>
333389
</table>
@@ -340,14 +396,16 @@
340396
<set token="detection_count">$job.resultCount$</set>
341397
</progress>
342398
<query>`get_attack_data`
343-
|rename Technique as mitre_technique
399+
| rename Technique as mitre_technique
344400
| join type=left max=0 mitre_technique
345-
[| sseanalytics
346-
|search mitre_id!="None"
347-
|mvexpand mitre_id
348-
|rename mitre_id as mitre_technique]
349-
|stats dc(name) by name,mitre_technique,channel
350-
|table name, mitre_technique, channel</query>
401+
[| sseanalytics
402+
| search mitre_id!="None"
403+
| mvexpand mitre_id
404+
| rename mitre_id as mitre_technique]
405+
| stats dc(name) by name, mitre_technique, displayapp
406+
| table name, mitre_technique, displayapp
407+
| rename name as "Detection", mitre_technique as "Att&amp;ck Technique", displayapp as "Source"
408+
</query>
351409
<earliest>$time_token.earliest$</earliest>
352410
<latest>$time_token.latest$</latest>
353411
<sampleRatio>1</sampleRatio>

0 commit comments

Comments
 (0)