Malware dashboard

The Malware dashboard is useful to identify possible malware outbreaks in your environment. It displays the status of malware events in your environment, and how that status changes over time based on data gathered by Splunk. The dashboard is used in ad-hoc searching of malware data, but is also the primary destination for drilldown searches used in the dashboard panels.

The Malware dashboard displays no results unless it is opened in response to a drilldown action, or you update a filter, select a time range, and select Submit.

Search malware events directly using Malware Search, or select chart elements or table rows to display raw events.

Malware filters

The dashboard assists in searching malware-related events based on the criteria defined by the search filters. You can use the filters to refine which events are shown.

Filter by Description
Time Range Select the time range to represent.
Action All, allowed, blocked, or deferred.
Destination Filter by the target asset, host, or IP address that received or was impacted by the malware event.
Signature Filter by the specific name, classification, or identifier assigned by an endpoint protection or security tool to a detected malware threat.
User Filter by the account name reported by the endpoint or antivirus tool as being active, logged in, or associated with the process when the malware event occurred.
File Filter by the file name associated with a detected malware infection or event.

Dashboard panels

The following table describes the panels for this dashboard.

Panel Description
Malware search An ad-hoc and drill-down search interface to investigate specific malware events and IOCs across your environment.
Malware events Normalized security log data representing malicious or potentially unwanted software activities detected by your endpoint protection tools (like antivirus, EDR, or proxy logs).