Certificate dashboard

The Certificate dashboard assists in searching SSL protocol data and SSL activity refined by the search filters. As an analyst, you can use these dashboards to view and review SSL encrypted traffic by usage without decrypting the payload. The dashboard searches display results based on the time period selected using the Time range picker.

The reports in the Certificate dashboard use fields in the Certificates data model. Relevant data sources include all devices or users generating SSL protocol traffic on the network captured from vulnerability scanners and packet analysis tools such as Splunk Stream and the Bro network security monitor.

Dashboard filters

Filter by	Description
Destination	Search by the destination IP address
Source	Search by the source IP address
Subject / Issuer common name	Search by the entity name of the certificate issuer.
Certificate hash	Search by the certificate hash, a unique cryptographic fingerprint of an individual SSL/TLS certificate.
Certificate serial number	Search by the serial number of the certificate
Subject/Issuer	Search by the issuer of the certificate.

Dashboard panels

Panel	Description
Certificate search	A dedicated search interface or drill-down destination that carries over your context (such as the specific ssl_subject_common_name, ssl_hash, or src IP) to perform a dedicated hunt on that certificate's history across the network.
Certificate events	Normalized security and operational log entries related to SSL/TLS, code-signing, or infrastructure digital certificates collected from network traffic, secure servers, and identity systems.