Malware dashboard

The Malware dashboard is useful to identify possible malware outbreaks in your environment. It displays the status of malware events in your environment, and how that status changes over time based on data gathered by Splunk. The dashboard is used in ad-hoc searching of malware data, but is also the primary destination for drilldown searches used in the dashboard panels.

The Malware Search dashboard displays no results unless it is opened in response to a drilldown action, or you update a filter, select a time range, and select Submit.

Search malware events directly using Malware Search, or select chart elements or table rows to display raw events.

Malware filters

The dashboard assists in searching malware-related events based on the criteria defined by the search filters. You can use the filters to refine which events are shown.

Filter by Description
Time range Select the time range to represent.
Business unit A group or department classification for the identity.
Category Filter based on the categories to which the malware belongs.
Action All, allowed, blocked, or deferred.

Key indicators

Displays the metrics relevant to the dashboard sources over the past 48 hours. Key indicators represent summary information and appear at the top of the dashboard. See Key indicators in Splunk Enterprise Security.

Key indicator Description
New infections Tracks newly identified malware signatures or first-time seen infections in your environment.
Multiple infections Tracks a single host or destination recording multiple malware signature alerts or recurring malicious events over a given timeframe.
Unique malware Tracks distinct, individual malware signatures, file names, or unique file hashes (file_hash) tracked and counted across endpoints by your security data or antivirus feeds.
Infected systems Tracks Infected systems, host computers, servers, or devices (dest fields) identified as experiencing a security event involving malicious software.
Total infections Tracks the overall count of detected malware events and distinct infection occurrences against endpoints over a selected time range.
Malware clients Tracks the endpoints, hosts, or user devices in your network that report malware activity, antivirus status, or endpoint protection agent data.
Old malware defs Tracks endpoints or clients running outdated antivirus signature versions that have not checked in or updated their threat definitions within a specified threshold.
Infected systems Tracks internal hosts or devices identified as targets of malicious software events.
Average infection length Tracks the average duration for which an infection such as a malware signature alert or a recurring malicious event was occurring over a given time frame.
Oldest infection Tracks the earliest recorded malware detections in your environment

Dashboard panels

The following table describes the panels for this dashboard.

Panel Description
Malware activity over time by action Shows all malware detected over the specified time period, split by action (allowed, blocked, deferred). Use this chart to detect whether too many malware infections are allowed.
Malware activity over time by signature Shows all malware detected over the specified time period, split by signature. Example signatures are Mal/Packer, LeakTest, EICAR-AV-Test, TROJ_JAVA.BY. Use this chart to detect which infections are dominant in your environment.
Top infections Shows a bar chart of the top infections in your environment, split by signature. This panel helps identify outbreaks related to a specific type of malware.
New malware - Last 30 days Shows new malware detected on the network over the last 30 days. For each malware signature identified, the date and time it was first detected and the total number of infections are shown. First-time infections are the most likely to cause outbreaks.
Clients by product version Shows a bar chart of the number of clients with a certain version of the endpoint protection product installed.
Clients by signature version Shows a bar chart of the number of clients with a certain signature version.
Repeat infections Shows repeated malware infections. Sort by signature, destination, action, or number of days.
Oldest infections Shows the oldest malware infections in your environment. Sort by date that the infection was detected (first or last time), the signature, destination host (affected system), or days the infection has been active.