Executive summary dashboard

The Executive summary dashboard is designed to provide a high level insight into security operations so that executives can evaluate security trends over time based on key metrics, findings, risk, and other additional metrics. Use the Executive Summary dashboard to prioritize security operations, monitor the overall health and evaluate the risk to your organization.

Note: You have the option to include suppressed findings in this dashboard. You can also display results based on a specific time range such as 7 days or 24 hours, and so on. Additionally, you cna filter the results based on team-based queues.

Key metrics or key indicators

Panel Description and default search
Mean time to triage Displays the average time in minutes to triage or prioritize an investigation over the duration of a specified time period. Also, displays a trendline in absolute value that indicates how the mean time taken to triage the finding compares to the previous mean time taken to triage the finding over the same time period. For example, the trendline may display that the mean time to triage a finding over the last 7 days is 0.5% up or down over the mean time taken to triage the finding during the previous 7 day time period. For more information, see Triage findings and finding groups in Splunk Enterprise Security.
CODE 
| tstats summariesonly=true earliest(_time) as _time FROM datamodel=Incident_Management BY "Notable_Events_Meta.rule_id"
    | rename "Notable_Events_Meta.*" as "*"
    | lookup update=true incident_updates_lookup rule_id OUTPUTNEW time
    | search time=*
    | stats earliest(_time) as create_time, earliest(time) as triage_time by rule_id
    | eval diff=triage_time-create_time, stat_type=if(create_time < relative_time(now(), "-7d@d"), "past", "current"), past=if(stat_type="past", 1, 0), 
    current=if(stat_type="current", 1, 0), past_diff=if(stat_type="past", diff, 0), current_diff=if(stat_type="current", diff, 0)
    | stats sum(past) AS past, sum(current) AS current, sum(past_diff) AS past_diff, sum(current_diff) as current_diff
    | eval past = round(past_diff/past/60), current = round(current_diff/current/60)
    | table past, current
    | transpose
    | rename "column" as stat_type,"row 1" as mean_triage_time
    | fillnull value=0 mean_triage_time
Mean time to resolution Displays the average time in minutes taken by the finding to reach its configured end status over the duration of a specified time period. Also, displays a trendline in absolute value that indicates how the mean time taken by the finding to reach its configured end status compares to the previous mean time taken by the finding to reach its configured end status over the same time period.
CODE 
| tstats summariesonly=true earliest(_time) as _time FROM datamodel=Incident_Management BY "Notable_Events_Meta.rule_id"
    | rename "Notable_Events_Meta.*" as "*"
    | eval temp_time=time()+86400
    | lookup update=true event_time_field=temp_time incident_review_lookup rule_id OUTPUTNEW time, status
    | `get_reviewstatuses`
    | search time=* AND status_end=true
    | stats first(_time) as create_time, last(time) as resolve_time by rule_id
    | eval diff=resolve_time-create_time, stat_type=if(create_time < relative_time(now(), "-7d@d"), "past", "current"), past=if(stat_type="past", 1, 0), current=if(stat_type="current", 1, 0), past_diff=if(stat_type="past", diff, 0), current_diff=if(stat_type="current", diff, 0)
    | stats sum(past) AS past, sum(current) AS current, sum(past_diff) AS past_diff, sum(current_diff) as current_diff
    | eval past = round(past_diff/past/60), current = round(current_diff/current/60)
    | table past, current
    | transpose
    | rename "column" as stat_type,"row 1" as mean_resolution_time
    | fillnull value=0 mean_resolution_time
Investigations created Displays the number of investigations created in the SOC over the duration of a specified time period. Also, displays a trendline in absolute value that indicates how the mean number of investigations created compares to the previous mean number of investigations created over the same time period. For more information, see Start an investigation in Splunk Enterprise Security.
CODE 
| inputlookup investigation_lookup
    | where create_time > relative_time(now(), "-14d@d") 
    | stats count(eval(create_time < relative_time(now(), "-7d@d"))) AS past, count(eval(create_time >= relative_time(now(), "-7d@d"))) AS current
    | transpose
    | rename "column" as count_type, "row 1" as count

You can access the key performance indicator (KPI) panel for Investigations created on the Executive summary dashboard. Only the admin and the ess_admin roles have the manage_all_investigations capability by default. For all other roles such as ess_analystor ess_user, you see an error message on the Investigations created KPI panel. An administrator can add the manage_all_investigations capability for users that allows other users to access the Investigations created KPI panel on the executive summary dashboard. For more information on adding capabilities to a specific role, see Specify role capabilities.

Findings

Panel Description and default search
Distribution by urgency Displays the distribution of the urgency level that is calculated based on the severity and priority level of a finding over the duration of a specified time period. The distribution is based on the following categories: Critical, High, Medium, Low, Information, and Unknown. For more information, see How urgency is assigned to findings in Splunk Enterprise Security.
CODE 
`get_notable_index`  | eval `get_event_id_meval`, rule_id=event_id, temp_time=time()+86400 | lookup update=true correlationsearches_lookup _key as source OUTPUTNEW severity | lookup update=true event_time_field=temp_time incident_review_lookup rule_id OUTPUT urgency as new_urgency | eval urgency=if(isnotnull(new_urgency),new_urgency,urgency) | `get_urgency` | eval urgency = upper(substr(urgency,1,1)).lower(substr(urgency,2)) | timechart span=1d count by urgency
Findings by domain Displays the classification of the findings by security domains, such as Access, Endpoint, Network, Threat, Identity, and Audit over the duration of a specified time period.
CODE 
| tstats summariesonly=true earliest(_time) as _time, first(source) as source FROM datamodel=Incident_Management  BY "Notable_Events_Meta.rule_id" | lookup update=true correlationsearches_lookup _key as source OUTPUTNEW security_domain | fillnull value="threat" security_domain | lookup update=true security_domain_lookup security_domain OUTPUTNEW label as security_domain_label | timechart span=1d count by security_domain_label
Untriaged findings by domain Displays the classification the untriaged findings by security domain, such as Access, Endpoint, Network, Threat, Identity, and Audit over the duration of a specified time period.
CODE 
| tstats summariesonly=true earliest(_time) as _time, first(source) as source FROM datamodel=Incident_Management  BY "Notable_Events_Meta.rule_id" | rename "Notable_Events_Meta.*" as "*" | eval temp_time=time()+86400 | lookup update=true event_time_field=temp_time incident_review_lookup rule_id OUTPUT time as triage_time | where isnull(triage_time) | lookup update=true correlationsearches_lookup _key as source OUTPUTNEW security_domain | fillnull value="threat" security_domain | lookup update=true security_domain_lookup security_domain OUTPUTNEW label as security_domain_label | timechart span=1d count by security_domain_label
Top 10 untriaged findings by source Displays the top 10 untriaged findings by their sources over the duration of a specified time period.
CODE 
`get_notable_index`  | eval `get_event_id_meval`, rule_id=event_id, temp_time=time()+86400 | lookup update=true event_time_field=temp_time incident_review_lookup rule_id OUTPUT time as triage_time | where isnull(triage_time) | lookup update=true correlationsearches_lookup _key as source OUTPUTNEW rule_name | eval rule_name=if(isnull(rule_name),source,rule_name) | stats count by rule_name | sort - count | head 10
Untriaged findings by type Displays the classification of findings based on whether or not they indicate risk over the duration of a specified time period.
CODE 
`get_notable_index`  | eval `get_event_id_meval`, rule_id=event_id, temp_time=time()+86400 | lookup update=true event_time_field=temp_time incident_review_lookup rule_id OUTPUT time as triage_time | where isnull(triage_time) | eval type=if(isnotnull(risk_object), "Risk Notable", "Notable") | timechart span=1d count by type
Frequent finding sources Displays the sources that generate the most number of findings over the duration of a specified time period.
CODE 
`get_notable_index`  | eval source=case(isNotNull(orig_source), orig_source, isNotNull(source_correlation_search), source_correlation_search, 1=1, source) | lookup update=true correlationsearches_lookup _key as source OUTPUTNEW rule_name | eval rule_name=if(isnull(rule_name),source,rule_name) | stats count by rule_name | sort - count | head 10
Rare finding sources Displays the sources that generate the least number of findings over the duration of a specified time period.
CODE 
`get_notable_index`  | eval source=case(isNotNull(orig_source), orig_source, isNotNull(source_correlation_search), source_correlation_search, 1=1, source) | lookup update=true correlationsearches_lookup _key as source OUTPUTNEW rule_name | eval rule_name=if(isnull(rule_name),source,rule_name) | stats count by rule_name | sort + count | head 10|}

Finding groups

Panel Description and default search
Finding groups versus findings Displays the ratio of individual findings versus findings that are categorized in groups to track how effectively the detections are consolidating alert noise into actionable finding groups.
Intermediate findings contributing to finding groups Displays the number of events that are added to finding groups to track whether the detections were able to bundle the raw triggers into actionable finding groups.
Sources not contributing to finding groups Displays the number of detections that are not creating events or findings which can be categorized into finding groups to track whether a detection is creating alert noise or actually contributing to identify potential threats.

Additional Metrics

Panel Description and default search
Adaptive response actions fired Displays a graph indicating the type and frequency of the adaptive response actions that were triggered over the duration of a specified time period.
PYTHON 
| tstats summariesonly=true count from datamodel=Splunk_Audit.Modular_Actions where Modular_Actions.is_Modular_Action_Invocations=1 by _time, Modular_Actions.action_mode, Modular_Actions.action_name
    | `drop_dm_object_name("Modular_Actions")`
    | eval action_mode=if(action_mode="saved","automated", action_mode), action_name=action_mode+"-"+action_name
    | fields - action_mode | timechart span=1d sum(count) as count by action_name
Sources with finding action versus intermediate finding action enabled Displays a graph indicating how many sources that are turned on have finding actions versus internediate finding actions over the duration of a specified time period.
CODE 
| inputlookup correlationsearch_changes_lookup
    | where _time > relative_time(now(),"-7d@d") | sort - _time | bin _time span=1d
    | dedup label, _time | where (disabled == 0) | mvexpand actions
    | where actions="notable" OR actions="risk" | eval actions=if(actions="notable", "Notable Action", "Risk Action") | timechart span=1d count by actions
Active versus inactive detections Displays a bar chart that provides a distribution of the detections that are turned on versus detections that are turned off in the SOC over the duration of a specified time period.
CODE 
| inputlookup correlationsearch_changes_lookup | where _time > relative_time(now(),"-7d@d")
    | sort - _time | bin _time span=1d | dedup label, _time
    | timechart span=1d count by disabled | rename 0 as Enabled, 1 as Disabled
Note: For key indicator panels and time chart visualizations on the Executive Summary dashboard, some arguments in the underlying SPL searches may be dynamically updated based on the time range selected on the dashboard UI.