From 26f62082c3ac2aaf05791ff472e15d4dddc360f4 Mon Sep 17 00:00:00 2001 From: Sean Whalen <44679+seanthegeek@users.noreply.github.com> Date: Wed, 27 Mar 2024 15:40:19 -0400 Subject: [PATCH] Update Splunk dashboards --- splunk/dmarc_aggregate_dashboard.xml | 156 ++++++++++++++++----------- splunk/dmarc_forensic_dashboard.xml | 36 ++++--- 2 files changed, 114 insertions(+), 78 deletions(-) diff --git a/splunk/dmarc_aggregate_dashboard.xml b/splunk/dmarc_aggregate_dashboard.xml index ed40115..89a5920 100644 --- a/splunk/dmarc_aggregate_dashboard.xml +++ b/splunk/dmarc_aggregate_dashboard.xml @@ -1,6 +1,17 @@ -
+ A summary of aggregate DMARC report data + + + index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ + | table * + | rename spf_results{}.domain as envelope_domain spf_results{}.result as spf_result spf_results{}.scope as spf_scope dkim_results{}.selector as dkim_selector dkim_results{}.domain as dkim_domain dkim_results{}.result as dkim_result + | fillnull value=null source_reverse_dns source_base_domain dkim_selector dkim_domain dkim_result source_type source_name + | search dkim_selector=$dkim_selector$ dkim_domain=$dkim_domain$ source_type=$source_type$ source_name=$source_name$ + + $time_range.earliest$ + $time_range.latest$ +
@@ -27,10 +38,6 @@ * - - - * - * @@ -51,14 +58,42 @@ * + + + * + * + + + * + * + any + source_type + source_type + + index="email_ess" sourcetype="dmarc:aggregate" + | stats count by source_type + + + + + * + * + + + * + + + + * + @@ -71,10 +106,8 @@ SPF alignment - - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | chart sum(message_count) by spf_aligned - $time_range.earliest$ - $time_range.latest$ + + | stats sum(message_count) as message_count by spf_aligned @@ -83,10 +116,8 @@ DKIM alignment - - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | chart sum(message_count) by dkim_aligned - $time_range.earliest$ - $time_range.latest$ + + | stats sum(message_count) by dkim_aligned @@ -96,10 +127,8 @@ Passed DMARC - - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | chart sum(message_count) by passed_dmarc - $time_range.earliest$ - $time_range.latest$ + + | stats sum(message_count) by passed_dmarc @@ -110,12 +139,11 @@ Reporting organizations - - index="email" sourcetype="dmarc:aggregate" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | chart sum(message_count) by org_name | sort -sum(message_count) - $time_range.earliest$ - $time_range.latest$ + + | stats sum(message_count) as message_count by org_name | sort -message_count + @@ -124,12 +152,11 @@ Message sources by reverse DNS
- - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | fillnull value="none" | chart sum(message_count) by source_base_domain | sort -sum(message_count) - $time_range.earliest$ - $time_range.latest$ + + | fillnull value="none" | stats sum(message_count) as message_count by source_base_domain | sort -message_count + @@ -138,26 +165,35 @@ Message volume by header from
- - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | chart sum(message_count) by header_from | sort -sum(message_count) - $time_range.earliest$ - $time_range.latest$ + + | stats sum(message_count) as message_count by header_from | sort -message_count +
+ + + Message sources by name and type + + + | stats sum(message_count) as message_count by source_name, source_type | sort -message_count + + + +
+ + DMARC passage over time - - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | chart sum(message_count) by _time,passed_dmarc - $time_range.earliest$ - $time_range.latest$ + + | timechart sum(message_count) as message_count by passed_dmarc @@ -168,6 +204,7 @@ + @@ -175,15 +212,16 @@ Message disposition over time - - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | chart sum(message_count) by _time,disposition - $time_range.earliest$ - $time_range.latest$ + + | timechart sum(message_count) as message_count by disposition + + + @@ -191,10 +229,8 @@ Message volume by source country - - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | iplocation source_ip_address | stats count by Country | geom geo_countries featureIdField="Country" - $time_range.earliest$ - $time_range.latest$ + + | iplocation source_ip_address | stats count by Country | geom geo_countries featureIdField="Country" @@ -206,14 +242,13 @@ Source countries - - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | stats sum(message_count) by source_country | sort -sum(message_count) - $time_range.earliest$ - $time_range.latest$ + + | stats sum(message_count) as message_count by source_country | sort -message_count + @@ -224,13 +259,12 @@ Message sources by IP address
- - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | stats sum(message_count) by source_ip_address,source_reverse_dns,source_base_domain,source_country | sort -sum(message_count) - $time_range.earliest$ - $time_range.latest$ + + | stats sum(message_count) as message_count by source_ip_address,source_reverse_dns,source_base_domain,source_country | sort -message_count - + +
@@ -238,15 +272,15 @@ - SPF alignment details + SPF details - - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | fillnull value="none" | stats sum(message_count) by header_from,envelope_from,spf_results{}.result,spf_aligned,source_base_domain | sort -sum(message_count) - $time_range.earliest$ - $time_range.latest$ + + | stats sum(message_count) as message_count by header_from,envelope_from,spf_result,spf_aligned,source_base_domain +| sort -message_count - + +
@@ -254,14 +288,14 @@ - DKIM alignment details + DKIM details - - index="email" sourcetype="dmarc:aggregate" spf_aligned=$spf_aligned$ dkim_aligned=$dkim_aligned$ passed_dmarc=$passed_dmarc$ org_name=$org_name$ source_reverse_dns=$source_reverse_dns$ header_from=$header_from$ envelope_from=$envelope_from$ disposition=$disposition$ source_ip_address=$source_ip_address$ source_base_domain=$source_base_domain$ source_country=$source_country$ | fillnull value="none" | stats sum(message_count) by header_from,dkim_results{}.selector,dkim_results{}.domain,dkim_results{}.result,dkim_aligned,source_base_domain | sort -sum(message_count) - $time_range.earliest$ - $time_range.latest$ + + | stats sum(message_count) as message_count by header_from,dkim_selector,dkim_domain,dkim_result,source_base_domain +| sort -message_count +
diff --git a/splunk/dmarc_forensic_dashboard.xml b/splunk/dmarc_forensic_dashboard.xml index 6338ccc..be3b290 100644 --- a/splunk/dmarc_forensic_dashboard.xml +++ b/splunk/dmarc_forensic_dashboard.xml @@ -1,5 +1,13 @@ - + + + + index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=$header_from$ parsed_sample.headers.To=$header_to$ parsed_sample.headers.Subject=$header_subject$ source.ip_address=$source_ip_address$ source.reverse_dns=$source_reverse_dns$ source.country=$source_country$ + | table * + + $time_range.earliest$ + $time_range.latest$ +
@@ -37,12 +45,11 @@ Forensic samples - - index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=$header_from$ parsed_sample.headers.To=$header_to$ parsed_sample.headers.Subject=$header_subject$ source.ip_address=$source_ip_address$ source.reverse_dns=$source_reverse_dns$ source.country=$source_country$ | fillnull value="none" | stats count by arrival_date_utc,parsed_sample.headers.From,parsed_sample.headers.Sender,parsed_sample.headers.To,parsed_sample.headers.Reply-To,parsed_sample.headers.Subject | sort -arrival_date_utc - $time_range.earliest$ - $time_range.latest$ + + | table arrival_date_utc authentication_results parsed_sample.headers.From,parsed_sample.headers.To,parsed_sample.headers.Subject | sort -arrival_date_utc + @@ -54,10 +61,8 @@ Forensic samples by country - - index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=$header_from$ parsed_sample.headers.To=$header_to$ parsed_sample.headers.Subject=$header_subject$ source.ip_address=$source_ip_address$ source.reverse_dns=$source_reverse_dns$ source.country=$source_country$ | iplocation source.ip_address | stats count by Country | geom geo_countries featureIdField="Country" - $time_range.earliest$ - $time_range.latest$ + + | iplocation source.ip_address| stats count by Country | geom geo_countries featureIdField="Country" @@ -69,12 +74,11 @@ Forensic samples by IP address
- - index="email" sourcetype="dmarc:forensic" sourcetype="dmarc:forensic" parsed_sample.headers.From=$header_from$ parsed_sample.headers.To=$header_to$ parsed_sample.headers.Subject=$header_subject$ source.ip_address=$source_ip_address$ source.reverse_dns=$source_reverse_dns$ source.country=$source_country$ | fillnull value="none" | iplocation source.ip_address | stats count by source.ip_address,source.reverse_dns,Country | sort -count - $time_range.earliest$ - $time_range.latest$ + + | iplocation source.ip_address | stats count by source.ip_address,source.reverse_dns | sort -count + @@ -83,10 +87,8 @@ Forensic samples by country ISO code
- - index="email" sourcetype="dmarc:forensic" parsed_sample.headers.From=$header_from$ parsed_sample.headers.To=$header_to$ parsed_sample.headers.Subject=$header_subject$ source.ip_address=$source_ip_address$ source.reverse_dns=$source_reverse_dns$ source.country=$source_country$ | stats count by source.country | sort - count - $time_range.earliest$ - $time_range.latest$ + + | stats count by source.country | sort - count