Traffic dashboard

The Traffic dashboard profiles overall network traffic, helps detect trends in type and changes in volume of traffic, and helps to isolate the cause (for example, a particular device or source) of those changes. This helps to determine when a traffic increase is a security issue and when it is due to an unrelated problem with a server or other device on the network.

Dashboard filters

You can use the filters to limit which items are shown on the dashboard. You can filter the dashboard results by time range such as 7 days, 24 hours, and so on.

Filter by	Description
Business Unit	A group or department classification for the identity.
Category	Filter based on the categories to which the host belongs.
Action	Filter based on firewall rule actions.
Source	Filter based on source IP or name.
Destination	Filter based on destination IP or name.
Destination port	Filter based on destination host port.
Transport	Filter based on transport protocol.

Key indicators

Displays the metrics relevant to the dashboard sources over the past 48 hours. Key indicators represent summary information and appear at the top of the dashboard. See Key indicators in Splunk Enterprise Security.

Key indicator	Description
Traffic destinations	Tracks the number of target IP addresses, hosts, or network endpoints that are receiving data packets or connection requests across your network.
Protocol activity	Tracks the network traffic data across standard communication protocols—such as HTTP, DNS, TCP/UDP, TLS/SSL, and email.
Long lived connections	Displays TCP connections sustained longer than 3 minutes. A long duration connection between hosts may represent unusual or suspicious activity. The drilldown opens the traffic search dashboard and searches on the selected event.

Dashboard panels

These dashboard panels report on network data and the information collected from common network protocols. As an analyst, you can use these panels to gain insight into HTTP, DNS, TCP/UDP, TLS/SSL, and common email protocols across your system or network. These panels use packet capture data. Packet capture data contains security-relevant information not typically collected in log files. Integrating network protocol data provides a rich source of additional context when detecting, monitoring, and responding to security related threats.

Filter by	Description
Traffic search	Provides an overview of network data and is also the primary destination for drilldown searches.
Traffic events	Tracks individual network traffic log records captured from security controls like firewalls, routers, switches, and network monitors.
Traffic over time by action	Displays network traffic by action. The drilldown searches on the selected action and time range.
Traffic over Time by protocol	Displays the number of events per day for a specified protocol. The drilldown searches on the selected protocol and time range.
Scanning activity (many systems)	Displays network activity from port scanners or vulnerability scanners and helps identify unauthorized instances of these scanners. The drilldown searches on the selected source IP and time range.
Top sources	Displays the top sources of total traffic volume over the given time frame with a sparkline representing peak event matches. The drilldown searches on the selected source IP and time range.
Port/Protocol profiler	Displays the volume network transport and port activity over time, to evaluate if port activity is trending upwards or downwards. Sudden increases in unapproved port activity may indicate a change on the networked devices, such as an infection. The drilldown opens the "New Search" dashboard and searches on the selected transport destination port and time range.
New port activity	Displays a table of transport and port traffic communication that has newly appeared or been active over the trailing seven-day time frame.
Prohibited or insecure traffic over time	Displays the volume of prohibited network port activity over time, and helps determine if unapproved port activity is trending upwards or downwards. The drilldown opens the "New Search" dashboard and searches on the selected transport destination port and time range.
Prohibited traffic details	Displays a table of the number of prohibited network traffic events. The drilldown opens the "New Search" dashboard and searches on the selected source IP, destination IP, transport, port, and time range.
Connections by protocol	Displays the sum of all protocol connections, sorted by protocol over time. The connection distribution by protocol shows the most common protocols used in an environment, such as email protocols and HTTP/SSL. An exploited protocol may display a disproportionate number of connections for its service type.