Cloud security dashboards

You can explore your cloud security environment by displaying visualizations from your Amazon Web Services (AWS) and Microsoft 365 environments using the Cloud security dashboards. You can access the dashboards through the cloud security menu and use them for insights into potential security issues such as errors, unusual events, unintended access, and suspicious activity.

Prerequisites to using CloudSecurity dashboards

Using cloud security dashboards, you can onboard cloud data sources and explore your cloud security environment by displaying visualizations of your Amazon Web Services (AWS) and Microsoft 365 environments. To use cloud security dashboards, you must meet the following prerequisites:

Note: If you are currently using the Amazon Web Services (AWS) and Microsoft 365 TAs, you can configure your existing indexes following these steps, instead of creating a new index.
  1. Create indexes to populate the cloud security dashboards. For more information on creating custom indexes, see Create custom indexes.
  2. Provide the index name in the Splunk Enterprise Security app settings following these steps:
    1. From the Splunk Enterprise Security menu, select Configure then General and then General settings.
      This displays the configuration settings of Splunk Enterprise Security by applications.
    2. Navigate to AWS Index or Microsoft 365. The default index value for the AWS Index is: aws_security and the default index value for the Microsoft 365 is o365_security.
      Note: No indexes exist with the default names. You must create your own indexes to populate the cloud security dashboards and provide the name of the index field for both the AWS Index and the MS 365 Index.
    3. Populate the index name in the app settings for AWS Index and Microsoft 365 Index.
  3. Install the Splunk Add-on for Amazon Kinesis Firehose and Splunk Add-on for Microsoft Office 365 from Splunkbase. Installing these add-ons helps to populate the cloud security dashboards and use them for insights into potential security issues such as errors, unusual events, unintended access, and suspicious activity.
  4. Configure the add-ons to send data to the Splunk platform and prepare the Splunk platform to receive the data.

Now you can use the visualizations on the following cloud security dashboards to explore your Amazon Web Services (AWS) and Microsoft 365 environments.

Security group dashboard

Monitor security groups in your Amazon Web Services (AWS) environment so that you have visibility into your virtual firewalls and can manually detect any suspicious activity.

Use the Security group dashboard to monitor security group activity in the AWS environment, including error events, number of security groups and rules, any unused security groups, activity over time, and the detailed list of error activities.

Note: The security groups and security group rules panels are snapshots based on the AWS lambda ingestion interval of three hours. If no events occur during that interval, your dashboards continue to show data based on the last snapshot from three hours ago. Also, if no events occur during the time you've chosen in the time range picker, such as one hour, your dashboards still show data based on the last snapshot from three hours ago. See Data Ingestion Mechanisms and Intervals in Data Manager in the Data Manager User Manual.
  1. From the Splunk Enterprise Security menu bar, select Analytics and then Cloud security.
  2. Select Security groups.

The Security group dashboard includes the following panels:

Panel Source Type Datamodel
Error events aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Network_Changes
Security group actions aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Network_Changes
Security group activity over time aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Network_Changes
Most recent security group activity aws:cloudtrail datamodel:"Change"."Network_Changes"
Most recent authorize and revoke activity aws:cloudtrail datamodel:"Change"."Network_Changes"
Security group error activity aws:cloudtrail datamodel:"Change"."Network_Changes"

Network ACLs dashboard

Monitor your Amazon Web Services (AWS) network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper when the facts warrant it.

Use the Network ACLs dashboard to monitor the network ACL activity in your AWS environment, including error events, the number of network ACLs, activity over time, and the detailed list of error activities.

  1. From the Splunk Enterprise Security menu bar, select Analytics and then Cloud Security.
  2. Select Network ACLs.

The Network ACLs dashboard includes the following panels:

Panel Source Type Datamodel
Error events aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Network_Changes
Network ACL actions aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Network_Changes
Network ACL activity over time aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Network_Changes
Most recent network ACLs activity aws:cloudtrail datamodel:"Change"."Network_Changes"
Network ACL error activity aws:cloudtrail datamodel:"Change"."Network_Changes"

Access analyzer dashboard

Monitor your Amazon Web Services (AWS) shared resources to identify potential unintended access. Use the Access analyzer dashboard to monitor your AWS public facing queues, lambdas, and S3 buckets.

  1. From the Splunk Enterprise Security menu bar, select Analytics and then Cloud security.
  2. Select Access analyzer.

The Access analyzer dashboard includes the following panels:

Panel Source Type Datamodel
Number of public facing queues aws:accessanalyzer:finding n/a
Number of public facing AWS lambda aws:accessanalyzer:finding n/a
Number of public facing S3 buckets aws:accessanalyzer:finding n/a
Access analyzer trend aws:accessanalyzer:finding n/a