Web dashboards
You can use the Web dashboards to profile web traffic events and identify potential and persistent threats in your deployment. This dashboard reports on web traffic gathered by Splunk from proxy servers. It is useful for troubleshooting potential issues such as excessive bandwidth usage, or proxies that are no longer serving content for proxy clients. You can also use the Web dashboards to profile the type of content that clients are requesting, and how much bandwidth is being used by each client.
Dashboard filters
Use the filters at the top of the screen to limit which items are shown.
| Filter by | Description |
|---|---|
| Time Range | Select the time range to represent. |
| Business Unit | A group or department classification for the identity. |
| Category | Filter based on the categories to which the host belongs. |
| Domain | Filter web traffic events based on specific areas of an organization's IT infrastructure. |
| Domain type | Filter web traffic events based on a domain such as Access, Endpoint, Identity, Network, and Threat. |
| Maximum age | Filter by the maximum age of newly seen or newly registered web traffic domains. |
| User | Filter web traffic by user activity |
| Watchlisted users | Filter web traffic by watchlisted users such as specific employee accounts or identities flagged as high-risk or requiring closer oversight. |
Key indicators
| Key indicator | Description |
|---|---|
| Unique URLs | Shows the current rate of proxy events. |
| Unique sources | Displays the number of distinct source hosts. |
| Unique destinations | Displays the number of distinct destination hosts. |
| Non corp volume | Shows the count of requests blocked by policy. |
| Watchlisted websites | Summarizes total bandwidth consumed over the selected time range. |
Dashboard Panels
| Panel | Description |
|---|---|
| Top Sources | Tracks sources associated with the highest volume of network traffic. This is useful for identifying sources that are using an excessive amount of network traffic (for example, file-sharing hosts), or frequently-requested destinations generating large amounts of network traffic (for example, YouTube or Pandora). |
| New domain activity | Tracks and displays domains appearing in your network environment for the first time, which can be newly registered or simply newly seen by your logs. |
| New domain activity by age | Categorizes and visualizes recently accessed or newly registered domains by their age to help detect malicious network traffic. |
| New domain activity by TLD | Identifies and visualizes network web traffic interacting with top-level domains (TLDs like .xyz, .ru, .cc, etc.) that are newly registered or newly observed in your environment. |
| Registration details | Displays WHOIS and age-related contextual information for newly registered or newly seen web domains in your network. |
| Non corporate web uploads | Displays high-volume data upload and download activity by individual users to non-corporate or external domains. |
| Watchlisted site activity | Tracks web traffic requests made to specific domains or URLs flagged as high-risk or sensitive. |
Web Search
The Web Search dashboard assists in searching for web events that are of interest based on the criteria defined by the search filters. The dashboard is used in ad-hoc searching of web data, but is also the primary destination for drilldown searches used in the dashboard panels.
The Web Search dashboard displays no results unless it is opened in response to a drilldown action, or you update a filter, select a time range, and click Submit.
| Filter by | Description |
|---|---|
| HTTP Method | Filter based on HTTP Method. |
| HTTP Status | Filter based on HTTP Status code. |
| Source | Filter based on source IP or name. |
| Destination | Filter based on destination IP or name. |
| URL | Filter based on URL details. |
| Time range | Select the time range to view. |