Security group dashboard
Monitor security groups in your Amazon Web Services (AWS) environment so that you have visibility into your virtual firewalls and can manually detect any suspicious activity.
Use the Security group dashboard to monitor security group activity in the AWS environment, including error events, number of security groups and rules, any unused security groups, activity over time, and the detailed list of error activities.
Note: The security groups and security group rules panels are snapshots based on the AWS lambda ingestion interval of three hours. If no events occur during that interval, your dashboards continue to show data based on the last snapshot from three hours ago. Also, if no events occur during the time you've chosen in the time range picker, such as one hour, your dashboards still show data based on the last snapshot from three hours ago. See Data Ingestion Mechanisms and Intervals in Data Manager in the Data Manager User Manual.
- From the Splunk Enterprise Security menu bar, select Analytics and then Cloud security.
- Select Security groups.
The Security group dashboard includes the following panels:
| Panel | Source Type | Datamodel |
|---|---|---|
| Error events |
aws:cloudtrail
|
datamodel=Change.All_Changes
|
| Security group actions |
aws:cloudtrail
|
datamodel=Change.All_Changes
|
| Security group activity over time |
aws:cloudtrail
|
datamodel=Change.All_Changes
|
| Most recent security group activity |
aws:cloudtrail
|
datamodel:"Change"."Network_Changes"
|
| Most recent authorize and revoke activity |
aws:cloudtrail
|
datamodel:"Change"."Network_Changes"
|
| Security group error activity |
aws:cloudtrail
|
datamodel:"Change"."Network_Changes"
|