Vulnerabilities dashboard
The Vulnerability dashboard provides an overview of vulnerability events from device data and tracks the status and activity of the vulnerability detection products deployed in your environment. Use this dashboard to see the overall health of your scanning systems, identify long-term issues, and see systems that are no longer being scanned for vulnerabilities.
Dashboard filters
The dashboards displays a list of all vulnerability-related events based on the criteria defined by the search filters. The dashboard is used in ad-hoc searching of vulnerability data, but is also the primary destination for drilldown searches used in the dashboard panels.
| Filter by | Description |
|---|---|
| Time range | Select the time range to represent. |
| Business unit | Filter by a group or department classification for the identity. |
| Category | Filter based on the categories to which the host belongs. |
| Destination | Filter based on the target host, asset, device, or IP address that has been scanned and on which a vulnerability has been detected |
| Signature | Filter based on the specific name, title, or identifier of a detected security vulnerability as provided by your underlying vulnerability scanning tools (such as Qualys, Tenable/Nessus, or Rapid7). |
| Vulnerability category | Filter based on the vendor-defined categories mapped via the Splunk Common Information Model (CIM). |
| Reference (Bugtraq,cert, cve etc) | Filter that lets you query and filter tracking events based on globally recognized vulnerability indexing standards. |
Dashboard Panels
| Panel | Description |
|---|---|
| Vulnerabilities search | Provides an ad-hoc search interface to display a detailed, filterable list of all vulnerability-related events across your environment based on specific criteria. |
| Vulnerabilities events | Normalized records of security weaknesses or flaws detected on network hosts and systems by vulnerability scanners (such as Nessus, Qualys, or Tenable) and ingested into the Vulnerabilities data model. |
| Vulnerabilities by age | Displays detected security vulnerabilities grouped and measured by how long they have been active or open in your environment. |
| Delinquent scanning | Displays vulnerability scans or results that carry a severity level of "high". |