Audit and health dashboards

The Analyst queue dashboard provides an overview of activity on findings. The panels display how many findings are being reviewed and by which user, along with a list of the most recently reviewed events. The metrics on this dashboard allow security managers to review the activities of analysts.

To audit data from the analyst queue in Splunk Enterprise Security prior to version 3.2, you must perform an ad hoc search like the following example:

index=_audit sourcetype=incident_review |  rex  field=_raw "^(?<end_time>[^,]*),(?<rule_id>[^,]*),(?<owner>[^,]*),(?<urgency>[^,]*),(?<status>[^,]*),(?<comment>[^,]*),(?<user>[^,]*),(?<rule_name>[^,]*)"

The Suppression dashboard provides an overview of finding suppression activity. This dashboard shows how many events are being suppressed, and by whom, so that finding suppression can be audited and reported on.

The metrics on this dashboard allow security managers to review the activities of analysts, which is useful for tuning detections. You can identify detection rules that are generating more events than your analysts are capable of looking at, and tune them accordingly.

The Modular actions dashboard provides an overview of the response actions initiated by adaptive response actions, including finding creation and risk scoring.

The Per-panel filter dashboard provides information about the filters currently in use in your deployment.

The following table describes the panels for this dashboard.

The Threat intelligence dashboard tracks and displays the current status of all threat and generic intelligence sources. As an analyst, you can review this dashboard to determine if threat and generic intelligence sources are current, and troubleshoot issues connecting to threat and generic intelligence sources.

If an intelligence download fails, a search automatically creates a system message. See Troubleshoot intelligence downloads in Splunk Enterprise Security.

The Machine learning dashboard displays information related to usage of the Artificial Intelligence Toolkit (AITK).

Use the ES configuration dashboard to compare the latest installed version of Splunk Enterprise Security to prior releases and identify configuration anomalies. The dashboard does not report changes to add-ons (TA.) Select the previous version of Splunk Enterprise Security installed in your environment using the Previous ES Version filter.

The Forwarder dashboard reports on hosts forwarding data to Splunk Enterprise.

Use the search filters and time range selector to focus on groups of forwarders or an individual forwarder.

The Indexing dashboard is designed to help administrators estimate the volume of event data being indexed by Splunk Enterprise. The dashboard displays use EPD (events per day) as a metric to track the event volume per index, and the rate of change in the total event counts per index over time. The EPD applies only to event counts, and is unrelated to the volume per day metric used for licensing.

The Search audit dashboard provides information about the searches run in Splunk Enterprise. This dashboard is useful for identifying long running searches and tracking search activity by user.

The View audit dashboard reports on the most active views in Splunk Enterprise Security. The View audit dashboard allows tracking of views that are being accessed on a daily basis and helps to identify any errors triggered when users review dashboard panels.

The Managed lookups dashboard reports on managed lookups and collections such as services, data, transforms, KV Store lookups, and CSV lookups in Splunk Enterprise Security. The Managed lookups audit dashboard shows the growth of lookups over time and the markers for anomalous growth. You can use this to help determine if any managed lookups are growing too large for your particular environment's performance and need to be pruned.