Skip to content

Commit ff25da2

Browse files
ccl0utierccl0utier
authored
Merge pull request #6 from ccloutier-splunk/dev
Merge to changes to DEV branch
2 parents c47c2f8 + ea4b2dc commit ff25da2

File tree

3 files changed

+193
-117
lines changed

3 files changed

+193
-117
lines changed

‎README.md‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,41 @@
1-
# Splunk attack range reporting
1+
# Splunk Attack Range Reporting
22
A Splunk App for Attack Range Reporting. Provides dashboards for insights on your attack range simulations.
33

4-
5-
Splunk attack range repo can be found [here](https://github.com/splunk/attack_range)
4+
The Splunk Attack Range repo can be found [here](https://github.com/splunk/attack_range)
65

76
## What is it ?
8-
It is a Splunk app that provides dashboards that enable a user of Splunk attack range to have better view of what simulations run, relevant security content from other Splunk apps and overview of the available Atomic Red tests.
7+
It is a Splunk app that provides dashboards that enable a user of Splunk Attack Range to have better view of what simulations were run, relevant security content from other Splunk apps and overview of the available Atomic Red tests.
98

109
## Compatibility and dependencies
11-
v1.0.0 of the app is compatible with the below
10+
v1.0.x of the app is compatible with the following:
1211

13-
+ Splunk 8.0.x
12+
+ Splunk 8.x.x
1413
+ [Splunk Analytic Story execution v1.0](https://github.com/splunk/analytic_story_execution)
1514
+ [Splunk Security Content v1.0.x](https://splunkbase.splunk.com/app/3449/)
16-
+ [Security essentials v3.1.x](https://splunkbase.splunk.com/app/3435/)
15+
+ [Security Security Essentials v3.1.x](https://splunkbase.splunk.com/app/3435/)
1716

1817
### Dependencies
19-
v1.0.0 of the app has the following depencencies
18+
This application has the following depencencies:
2019

2120
+ [Punchcard - Custom Visualization](https://splunkbase.splunk.com/app/3129/)
22-
+ [Security essentials v3.1.x](https://splunkbase.splunk.com/app/3435/)
21+
+ [Splunk Security Essentials v3.x.x](https://splunkbase.splunk.com/app/3435/)
2322
+ [Status Indicator - Custom Visualization](https://splunkbase.splunk.com/app/3119/)
23+
+ [Sankey Diagram - Custom Visualization](https://splunkbase.splunk.com/app/3112/)
2424

2525
## What does it look like ?
2626

27-
Main dashboard is showing simulations run, users, hosts, MITRE ATT&CK tactics and techniques, tests executed and potential mapping with analytic stories.
27+
The Main dashboard gives you an overview of the simulations run, users, hosts, MITRE ATT&CK tactics and techniques, tests executed and potential mapping with analytic stories.
2828

2929
![Main Dashboard](appserver/static/docs/img/ar_main_dashboardv1.0.png?raw=true "Main Dashboard")
3030

31-
The second dashboard (Navigator) shows all the available atomic red tests and their potential mappings to security content. Reason it is "potential" is because the mapping is just been made based on the tactique referenced from the test and the security content. This does not necessarily mean that a specific atomic red test will detonate a detection. And this is where you should read more on what ATT&CK is all about :)
31+
The second dashboard (Navigator) shows all the available Atomic Red tests and their potential mappings to security content. The reason we categorize those as "potential" is because the mapping is simply made based on the MITRE tactic referenced in the test and the security content. This does not necessarily mean that a specific Atomic Red Test will trigger a particular detection. This is where you should read more on what ATT&CK is all about and how the Splunk [Security Content](https://research.splunk.com) maps to it. :)
3232

3333

3434
![Navigator](appserver/static/docs/img/ar_navigator_dashboardv1.0.png?raw=true "Navigator")
3535

36-
3736
Finally there is a dashboard made with Splunk dashboards - Beta which looks nice but still in beta !
3837

3938
![Main - Beta](appserver/static/docs/img/ar_dashboards_beta_preview.png?raw=true "Main-Beta")
4039

4140
## Contributors
42-
[Christian Cloutier](https://github.com/ccloutier-splunk)
41+
[Christian Cloutier](https://github.com/ccloutier-splunk)

‎default/data/ui/views/attack_range_main_dashboard.xml‎

Lines changed: 109 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@
22
<search id="BaseSearch">
33
<query>`get_attack_data`
44
|lookup enterprise-attack-lookup Technique
5-
| eval mitre_id = Technique+" - "+mitre_technique_display, atomic_test= 'Test Number'+"-"+'Test Name'
6-
| table atomic_test, Hostname,mitre_id,mitre_technique_display,mitre_technique_url,Tactic,Technique,"Test Name", Username
5+
| eval mitre_id = Technique + " - " + mitre_technique_display, atomic_test = 'Test Number' + "-" + 'Test Name'
6+
| sort -_time
7+
| table atomic_test, Hostname, mitre_id, mitre_technique_display, mitre_technique_url, Tactic, Technique, "Test Name", Username
78
</query>
89
<earliest>$time_token.earliest$</earliest>
910
<latest>$time_token.latest$</latest>
@@ -14,17 +15,34 @@
1415
| rest /services/apps/local
1516
| where title = "SplunkEnterpriseSecuritySuite"
1617
</query>
17-
<finalized >
18+
<finalized>
1819
<condition match=" 'job.resultCount' != 0">
19-
<set token="filterESLink">noop</set>
20-
</condition>
21-
<condition>
22-
<set token="filterESLink">rename view_es as _view_es</set>
23-
</condition>
24-
</finalized >
20+
<set token="filterESLink">noop</set>
21+
</condition>
22+
<condition>
23+
<set token="filterESLink">rename view_es as _view_es</set>
24+
</condition>
25+
</finalized>
26+
</search>
27+
<!-- Check if the SanKey Visualiztion is installed, and inform the user if not (and adapt the relevant panel content accordingly) -->
28+
<search id="SanskeyInstalledSearch">
29+
<query>
30+
| rest /services/apps/local
31+
| where title = "sankey_diagram_app"
32+
</query>
33+
<finalized>
34+
<condition match=" 'job.resultCount' != 0">
35+
<set token="SanskeyInstalled">1</set>
36+
<unset token="SanskeyNotInstalled"></unset>
37+
</condition>
38+
<condition>
39+
<unset token="SanskeyInstalled"></unset>
40+
<set token="SanskeyNotInstalled">1</set>
41+
</condition>
42+
</finalized>
2543
</search>
2644
<label>Attack Range Dashboard</label>
27-
<description>Shows tests already run and relevant statistics in addition to possible analytic stories for executed tests. Currently supports only Atomic Red tests</description>
45+
<description>Shows tests already run and relevant statistics in addition to possible Analytic Stories/Detections that might be used to detect executed tests. Currently supports only Atomic Red tests.</description>
2846
<fieldset submitButton="false">
2947
<input type="time" token="time_token" searchWhenChanged="true">
3048
<label>Time range</label>
@@ -39,7 +57,7 @@
3957
<title># Simulations run</title>
4058
<viz type="status_indicator_app.status_indicator">
4159
<search base="BaseSearch">
42-
<query>|stats count</query>
60+
<query>| stats count</query>
4361
</search>
4462
<option name="status_indicator_app.status_indicator.colorBy">static_color</option>
4563
<option name="status_indicator_app.status_indicator.fillTarget">text</option>
@@ -57,7 +75,7 @@
5775
<title># MITRE ATT&amp;CK Tactics</title>
5876
<viz type="status_indicator_app.status_indicator">
5977
<search base="BaseSearch">
60-
<query>|stats dc(Tactic)</query>
78+
<query>| stats dc(Tactic)</query>
6179
</search>
6280
<option name="drilldown">none</option>
6381
<option name="refresh.display">progressbar</option>
@@ -80,7 +98,7 @@
8098
<title># MITRE ATT&amp;CK Techniques</title>
8199
<viz type="status_indicator_app.status_indicator">
82100
<search base="BaseSearch">
83-
<query>|stats dc(Technique)</query>
101+
<query>| stats dc(Technique)</query>
84102
</search>
85103
<option name="drilldown">none</option>
86104
<option name="refresh.display">progressbar</option>
@@ -105,7 +123,7 @@
105123
<title>Attack username</title>
106124
<chart>
107125
<search base="BaseSearch">
108-
<query>|stats count by Username</query>
126+
<query>| stats count by Username</query>
109127
</search>
110128
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
111129
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
@@ -145,7 +163,7 @@
145163
<title>Target hosts</title>
146164
<chart>
147165
<search base="BaseSearch">
148-
<query>|stats count by Hostname</query>
166+
<query>| stats count by Hostname</query>
149167
</search>
150168
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
151169
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
@@ -187,7 +205,7 @@
187205
<title>Tactics simulated</title>
188206
<chart>
189207
<search base="BaseSearch">
190-
<query>|stats count by Tactic</query>
208+
<query>| stats count by Tactic</query>
191209
</search>
192210
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
193211
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
@@ -244,12 +262,50 @@
244262
</viz>
245263
</panel>
246264
</row>
265+
<row>
266+
<panel depends="$SanskeyInstalled$">
267+
<title>Executed Simulations [$simulation_count$]</title>
268+
<viz type="sankey_diagram_app.sankey_diagram">
269+
<search>
270+
<progress>
271+
<set token="simulation_count">$job.resultCount$</set>
272+
</progress>
273+
<query>`get_attack_data`
274+
| lookup enterprise-attack-lookup Technique
275+
| eval Label = Tactic + " - " + mitre_tactic_display
276+
| eval Label2 = Technique + " - " + mitre_technique_display
277+
| stats count by Label2, Label
278+
| table Label, Label2, count
279+
| rename Label as step1, Label2 as step2
280+
| append [
281+
search `get_attack_data`
282+
| lookup enterprise-attack-lookup Technique
283+
| eval Label = Technique + " - " + mitre_technique_display
284+
| eventstats dc("Test Name") as count by Label, Tactic, "Test Name"
285+
| table Label, "Test Name", count
286+
| rename Label as step1, "Test Name" as step2
287+
]</query>
288+
<earliest>$time_token.earliest$</earliest>
289+
<latest>$time_token.latest$</latest>
290+
</search>
291+
<option name="drilldown">none</option>
292+
</viz>
293+
</panel>
294+
<panel depends="$SanskeyNotInstalled$">
295+
<html>
296+
<p>In order for this panel to show properly, please install the SanKey visualization available <a href="https://splunkbase.splunk.com/app/3112/">here</a></p>
297+
</html>
298+
</panel>
299+
</row>
247300
<row>
248301
<panel>
249-
<title>Executed simulations</title>
302+
<title>Executed Simulations [$simulation_count$] - Details</title>
250303
<table>
251304
<search base="BaseSearch">
252-
<query>|table atomic_test, Hostname,mitre_id,mitre_technique_display,mitre_technique_url,Tactic,Technique,"Test Name", Username
305+
<progress>
306+
<set token="simulation_count">$job.resultCount$</set>
307+
</progress>
308+
<query>| rename atomic_test as "Atomic Red Test", mitre_id as "MITRE ID", mitre_technique_display as "Name", mitre_technique_url as "Technique URL", Username as "User Name"
253309
</query>
254310
</search>
255311
<option name="count">5</option>
@@ -275,29 +331,29 @@
275331
and also normalizes the field for other fringe cases (duplicate spaces, extra spaces at the end, etc.) -->
276332
<query>`get_attack_data`
277333
| lookup enterprise-attack-lookup Technique
278-
| eval mitre_id = Technique+" - "+mitre_technique_display, atomic_test= 'Test Number'+"-"+'Test Name'
279-
280-
| join type=left max=0 Technique
281-
[
282-
| rest /services/configs/conf-analytic_stories splunk_server=local count=0
283-
| rex field=mappings ".*,+\s\"mitre_attack\":(?&lt;technique&gt;.*),+\s\"nist\""
284-
| rex field=technique mode=sed "s/\[//g"
285-
| rex field=technique mode=sed "s/\]//g"
286-
| eval technique=split(technique, ",")
287-
| rex field=technique mode=sed "s/\"//g"
288-
| mvexpand technique
289-
| eval Technique=trim(technique)
290-
| where Technique!=""
291-
| fields Technique, title
292-
]
334+
| rename Technique as mitre_attack
335+
| stats count by mitre_attack
336+
| fields mitre_attack
337+
| join mitre_attack max=0 [
338+
| rest /services/configs/conf-savedsearches splunk_server=local count=0
339+
| search action.escu.search_type = detection
340+
| spath input=action.correlationsearch.annotations path=analytic_story{} output="analytic_story"
341+
| spath input=action.correlationsearch.annotations path=mitre_attack{} output="mitre_attack"
342+
| fields analytic_story, mitre_attack, title
343+
| mvexpand mitre_attack
344+
| search mitre_attack!=""
345+
| stats dc(title) as detections by analytic_story, mitre_attack
346+
]
293347
| eval view_es="View [ES]"
294348
| eval view_sse="View [SSE]"
295349
| eval view_docs="View [Docs]"
296350
| eval execute="Execute [ASX]"
351+
| rename analytic_story as title
297352
| eval _docs_title = trim(replace(title, "\s+", " "))
298-
| eval _docs_title = upper(substr(mvjoin(split(lower(_docs_title), " "), "_"),1,1)).substr(mvjoin(split(lower(_docs_title), " "), "_"), 2)
299-
| stats dc(title) by title, _docs_title, view_es, view_docs, execute
300-
| fields title, _docs_title, view_es, view_docs, execute
353+
| eval _docs_title = lower(substr(mvjoin(split(lower(_docs_title), " "), "_"),1,1)).substr(mvjoin(split(lower(_docs_title), " "), "_"), 2)
354+
| fields title, mitre_attack, detections, _docs_title, view_es, view_docs, execute
355+
| eval _title = title
356+
| rename title as "Analytic Story", mitre_attack as "Att&amp;ck Technique", detections as "Detections", view_es as "ES Link", view_docs as "Docs Link", execute as "Run in ASX"
301357
| $filterESLink$
302358
</query>
303359
<earliest>$time_token.earliest$</earliest>
@@ -313,21 +369,21 @@
313369
<option name="totalsRow">false</option>
314370
<option name="wrap">true</option>
315371
<drilldown>
316-
<condition field="view_es">
372+
<condition field="ES Link">
317373
<link target="_blank">/app/SplunkEnterpriseSecuritySuite/ess_analytic_story_details?analytic_story=$click.value$</link>
318374
</condition>
319-
<!--<condition field="view_sse">
375+
<!--<condition field="SSE Link">
320376
<link target="_blank">/app/Splunk_Security_Essentials/TBD?=$click.value$</link>
321377
</condition>-->
322-
<condition field="view_docs">
323-
<link target="_blank">https://docs.splunk.com/Documentation/ESSOC/latest/stories/UseCase#$row._docs_title$</link>
378+
<condition field="Docs Link">
379+
<link target="_blank">https://research.splunk.com/stories/$row._docs_title$</link>
324380
</condition>
325381
<!-- Default link is the documentation -->
326-
<condition field="title">
327-
<link target="_blank">https://docs.splunk.com/Documentation/ESSOC/latest/stories/UseCase#$row._docs_title$</link>
382+
<condition field="Analytic Story">
383+
<link target="_blank">https://research.splunk.com/stories/$row._docs_title$</link>
328384
</condition>
329-
<condition field="execute">
330-
<link target="_blank">/app/Splunk_ASX/execute?form.mode=now&amp;form.time.earliest=-24h@h&amp;form.time.latest=now&amp;form.story=$row.title$</link>
385+
<condition field="Run in ASX">
386+
<link target="_blank">/app/Splunk_ASX/execute?form.mode=now&amp;form.time.earliest=-24h@h&amp;form.time.latest=now&amp;form.story=$row._title$</link>
331387
</condition>
332388
</drilldown>
333389
</table>
@@ -340,14 +396,16 @@
340396
<set token="detection_count">$job.resultCount$</set>
341397
</progress>
342398
<query>`get_attack_data`
343-
|rename Technique as mitre_technique
399+
| rename Technique as mitre_technique
344400
| join type=left max=0 mitre_technique
345-
[| sseanalytics
346-
|search mitre_id!="None"
347-
|mvexpand mitre_id
348-
|rename mitre_id as mitre_technique]
349-
|stats dc(name) by name,mitre_technique,channel
350-
|table name, mitre_technique, channel</query>
401+
[| sseanalytics
402+
| search mitre_id!="None"
403+
| mvexpand mitre_id
404+
| rename mitre_id as mitre_technique]
405+
| stats dc(name) by name, mitre_technique, displayapp
406+
| table name, mitre_technique, displayapp
407+
| rename name as "Detection", mitre_technique as "Att&amp;ck Technique", displayapp as "Source"
408+
</query>
351409
<earliest>$time_token.earliest$</earliest>
352410
<latest>$time_token.latest$</latest>
353411
<sampleRatio>1</sampleRatio>

0 commit comments

Comments
 (0)