Certificate dashboard
The Certificate dashboard displays an overview of the temporary, expired certificates. It also assists in searching SSL protocol data and SSL activity refined by the search filters. As an analyst, you can use these dashboards to view and review SSL encrypted traffic by usage without decrypting the payload. The dashboard searches display results based on the time period selected using the Time range picker.
The reports in the Certificate dashboard use fields in the Certificates data model. Relevant data sources include all devices or users generating SSL protocol traffic on the network captured from vulnerability scanners and packet analysis tools such as Splunk Stream and the Bro network security monitor.
Key indicators
Displays metrics relevant to the dashboard sources over the past 48 hours. Key indicators represent summary information and appear at the top of the dashboard.
| Key indicators | Description |
|---|---|
| Short validity certificates | Number of SSL/TLS digital certificates designed with highly abbreviated lifespans such as 47 to 200 days or even less, rather than the traditional 1 to 3 years. |
| Expired certificates | Number of outdated SSL/TLS or SAML cryptographic certificates that cause connection errors, log bloat, and potential data-forwarding interruptions between components like forwarders, indexers, and search heads. |
Dashboard panels
| Panel | Description |
|---|---|
| SSL activity by common name | Displays outbound SSL connections by common name (CN) of the SSL certificate used. An unfamiliar domain receiving a large number of SSL connections from hosts on the network may represent unusual or suspicious activity. The drilldown redirects the page to the SSL search dashboard, and searches on the selected common name. |