Splunk - Drop Down Management Dashboard for Attacks

Scenario: You might have many security devices as input resource and many of them have standard apps already designed for Splunk(Also available for free) but even then in some cases you would like to create your own Dashboards based on your own requirements especially when you would like to report to the management customers and so on.

Here I will explain a Web Application Firewall as an input resource where we might have multiple services registered into WAF and in Splunk you would like to create a dashboard for management based on a drop down menu for different services.

To start with, we will use the same lookup that we have created in my previous blog.

First you need to know what you would like to present in a dashboard. In my case, I am taking a simple scenario that I would like to present the number of attacks from a country that is happening to any particular service in a given period of time. It would also present some additional details like as follows:

Time

Source IP

Country

Action Taken

URL

Destination IP

Attack Description

Count

Data Source in this case is Web Application Firewall. You can achieve the same for any other data source.

In order to present the information mentioned in above table, I am using following as a raw query. I am looking for the logs from WAF, and on top of that in this particular case I am checking only the deny logs.

sourcetype=waf_firewall src_ip="*" dest_ip="*" deny  |  geoip src_ip | fillnull value=NULL | stats c as "Count" by _time src_ip src_ip_country_name action_taken  URL dest_ip Attack_Description |rename src_ip as Source_IP src_ip_country_name as Country action_taken as Action_Taken | sort -_time

Note: If you look at the query you might notice that the src_ip and dest_ip are both asterisk (*) respectively. Because I would like to give a user this flexibility that he/she may select dest_ip from the dropdown menu and in case of src_ip they may be able to verify the attacks from any particular IP.

Once you are convinced with your raw query what you would like to show as in Dashboard, you should save it as a dashboard.

 

You will have to provide following self-explanatory details based upon how you would like to present this dashboard. You can either integrate your dashboard to an existing one or you can start with a new dashboard. Next assign a Dashboard ID and you may change the dashboard permissions as well.

Once you have the dashboard, you would like add the panels, based on this scenario we will need three panels.

• Attacker IP 
• Service IP
• Timeline

Go to your dashboard and click on Edit on the top right corner and Edit Panels

 

Afterwards you have to add predefined input from available inputs:

In our case we would require two text fields and a time field. Add text field two times and the time field for our customized timeline. In case of Source IP, we will start with all IPs where the attacks might come from hence we would fill it in with wildcard * and in case of Destination IP we will use our pre-defined lookup, which is basically a list of services that includes the name of the service and the respective IPs.

Source IP:  In order to edit source IP field click the pencil button and edit the required field as shown below, here the name of the token is very important therefore we should remember it so that later on we can manipulate our query to get the input from our pre-defined fields.

Destination IP: In case of destination IP, we will dynamically fill it with our lookup therefore scroll down and check for the Dynamic Options. Here you may insert your query that can get the input from your lookup. In fact you may use any Splunk query here depending upon your use case.

In our case, we will do as follows:

In this case, we have defined the token as service

And finally our input field will look like as follows: 

 

We have now almost all our requirements fulfilled and we are almost done. Last thing we would like to achieve is that our dashboard should display the results based upon our selected input filed e.g. if you select a service from a drop-down menu, it should only show results for that particular service.

Therefore click again onto Edit on the top right corner and Edit Panels and then edit search string.

It will pop-up a new window where you can edit your search query as well and you can also integrate your time line to the dashboard.

As we have shown earlier that in case of src_ip and dest_ip we have chosen wild card * as our input value, now in order to fill it in with our dynamic input fields we have to utilize the tokens that we have defined earlier for our inputs.

Tokens: Tokens are like programming variables that represents a value that can change based upon user selection. In a search query token name uses following syntax e.g. $TokenName$

For details you may check Splunk documentation which explains in detail where you can use a token and what you may achieve out of it in different scenarios.

Finally we change our search query  and the value of  src_ip and dest_ip we will receive from our input as follows:

sourcetype=waf_firewall src_ip="$Attacker_IP$" dest_ip="$service$

For Time Range Scope select Shared Time Picker so that if you change the time, content of dashboard also change and you are ready to go.

Finally your dashboard should look like as follows:

Once you select a service that is registered into WAF and you have logs from it into Splunk it should give us the desired results.

E.g. Below: