Intrusion Detection dashboard
The Intrusion Detectiondashboard provides an overview of all network intrusion events from Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) device data. This dashboard assists in reporting on IDS activity to display trends in severity and in volume of IDS events.
The dashboard is used in ad-hoc searching of network data, but is also the primary destination for drilldown searches used in the dashboard panels.
Intrusion detection filters
The dashboard assists in searching IDS-related events such as attacks or reconnaissance-related activity, based on the criteria defined by the search filters.
| Filter by | Description |
|---|---|
| Time Range | Select the time range to view. |
| Business Unit | A group or department classification for the identity. |
| Category | Filter based on the categories to which the host belongs. |
| Severity | Filter based on event severity. |
| IDS Type | Filter based on events matching a specified type of IDS. |
| IDS Category | Filter based on events matching vendor-defined categories. |
Key indicators
Displays the metrics relevant to the dashboard sources over the past 48 hours. Key indicators represent summary information and appear at the top of the dashboard. See Key indicators in Splunk Enterprise Security.
| Key indicators | Description |
|---|---|
| High severity attacks | Tracks events where the security event's severity field is explicitly classified as high or critical. |
| Attack categories | Tracks the ids_type and vendor-defined category fields to classify attacks. |
| Attack signatures | Tracks the specific names, event codes, or predefined threat patterns matched by an IDS/IPS device when suspicious or unauthorized traffic occurs. |
| Attack sources | Tracks the origin points of suspicious or malicious network activity identified by your intrusion detection systems (IDS/IPS). |
| Attack destinations | Tracks the target systems, hosts, or IP addresses (dest / dest_ip) on your network that are receiving malicious or suspicious traffic flagged by your Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS). |
Dashboard panels
| Panel | Description |
|---|---|
| Attacks over time by severity | Displays the top attacks over time by severity. |
| Top Attacks | Displays the top attacks by count and signature. |
| Scanning Activity (Many Attacks) | Displays source IP addresses showing a pattern of attacks. |