parent
2e8319b469
commit
4347051769
@ -0,0 +1,107 @@
|
|||||||
|
Netwrix (STEALTHbits) Active Directory Monitoring App for Splunk
|
||||||
|
|
||||||
|
Netwrix (STEALTHbits')Threat Manager provides many valuable controls for your
|
||||||
|
IT infrastructure, and has many ways to utilize that data including real-time
|
||||||
|
blocking and alerting. But holistic data reporting requires a more broad
|
||||||
|
reaching platform such as Splunk. This app helps provide insight into the most
|
||||||
|
common activities happening around your Active Directory.
|
||||||
|
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
Version Support
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
v.2.0.0
|
||||||
|
- Add app compatibility with Splunk Cloud environments
|
||||||
|
- Netwrix rebranding
|
||||||
|
- Add usage of Splunk "stealthData" macro
|
||||||
|
- Modify eventtype names to remove ':' character usage, and replaced
|
||||||
|
spaces with "_"
|
||||||
|
- Removed the "StealthINTERCEPT File System Activity" eventtype
|
||||||
|
- Update extractions to handle both "StealthINTERCEPT" and "STEALTHbits"
|
||||||
|
source types
|
||||||
|
- Added extra CIM compliance fields
|
||||||
|
- Changed the mapping of "Windows File System Access Rights Change" from
|
||||||
|
"modified" to "acl_modified" in the "action" field
|
||||||
|
- Removed "success" and "failure" as possible values in "action" field.
|
||||||
|
These are now part of the "status" field
|
||||||
|
- Changed the AD active users panel on the overview dashboard, to
|
||||||
|
break down the count by AD type
|
||||||
|
|
||||||
|
v.1.1.1
|
||||||
|
- Improved support for analytics on authentication attacks page
|
||||||
|
|
||||||
|
v.1.1.0
|
||||||
|
- Improved query efficiency
|
||||||
|
- Added CIM compliance
|
||||||
|
- Added LDAP monitoring page
|
||||||
|
|
||||||
|
v.1.0.0
|
||||||
|
- Initial Release of App
|
||||||
|
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
System Requirements
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Splunk Console
|
||||||
|
StealthINTERCEPT
|
||||||
|
Machine Learning Toolkit for Splunk
|
||||||
|
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
Installation
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
1. Log in to Splunk Web and navigate to Apps > Manage Apps.
|
||||||
|
2. Click Install App from file.
|
||||||
|
3. Upload the file and click Upload.
|
||||||
|
4. Restart Splunk Web.
|
||||||
|
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
Collecting Data
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Configure the StealthINTERCEPT server to send data to Splunk via Syslog.
|
||||||
|
|
||||||
|
You may choose to use SC4S, a Syslog server with a Universal Forwarder or
|
||||||
|
direct Heavy Forwarder ingest.
|
||||||
|
|
||||||
|
In all cases, you should configure your favoured approach to ingest the data
|
||||||
|
with the sourcetype "StealhINTERCEPT"
|
||||||
|
|
||||||
|
You may also choose to create a dedicated index. You should recall the
|
||||||
|
specified index name for the next step
|
||||||
|
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
Configuration
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
To expedite search performance configure the "stalthData" macro.
|
||||||
|
|
||||||
|
This can be configured by going to
|
||||||
|
Settings -> Advanced Search -> Search macros:
|
||||||
|
- stealthData.
|
||||||
|
|
||||||
|
This is used to improve search performance and should be appropriately
|
||||||
|
modified to specify the index(es) you defined in the previous step.
|
||||||
|
|
||||||
|
E.g.
|
||||||
|
index=[yourStealDataIndex] (sourcetype=STEALTHbits OR sourcetype=
|
||||||
|
StealthINTERCEPT)
|
||||||
|
|
||||||
|
If left unmodified, this defaults to searching across all indexes in the
|
||||||
|
Splunk environment.
|
||||||
|
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
Troubleshooting
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Data does not show up in the dashboard pages.
|
||||||
|
- Make sure that StealthINTERCEPT is configured to send data to Splunk.
|
||||||
|
- Make sure that StealthINTERCEPT as a UDP log source in Splunk and has
|
||||||
|
the correct sourcetype and index definition.
|
||||||
|
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
Support
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Netwrix (STEALTHbits) Support:
|
||||||
|
splunk@netwrix.com# Binary File Declaration
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
[base]
|
||||||
|
builder_version = <string>
|
||||||
|
builder_build = <string>
|
||||||
|
is_edited = <bool>
|
||||||
@ -0,0 +1,53 @@
|
|||||||
|
{
|
||||||
|
"schemaVersion": "1.0.0",
|
||||||
|
"info": {
|
||||||
|
"title": "Netwrix Active Directory and LDAP Monitoring",
|
||||||
|
"id": {
|
||||||
|
"group": null,
|
||||||
|
"name": "stealthbits_ad_ldap",
|
||||||
|
"version": "2.0.0"
|
||||||
|
},
|
||||||
|
"author": [
|
||||||
|
{
|
||||||
|
"name": "Netwrix Corporation",
|
||||||
|
"email": null,
|
||||||
|
"company": null
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"releaseDate": null,
|
||||||
|
"description": "Netwrix Threat Manager provides many valuable controls for your IT infrastructure, and has many ways to utilize that data including real-time blocking and alerting. But holistic data reporting requires a more broad reaching platform such as Splunk. This app helps provide insight into the most common activities happening around your Active Directory Learn more about Netwrix at https://www.Netwrix.com/.",
|
||||||
|
"classification": {
|
||||||
|
"intendedAudience": null,
|
||||||
|
"categories": [],
|
||||||
|
"developmentStatus": null
|
||||||
|
},
|
||||||
|
"commonInformationModels": null,
|
||||||
|
"license": {
|
||||||
|
"name": null,
|
||||||
|
"text": null,
|
||||||
|
"uri": null
|
||||||
|
},
|
||||||
|
"privacyPolicy": {
|
||||||
|
"name": null,
|
||||||
|
"text": null,
|
||||||
|
"uri": null
|
||||||
|
},
|
||||||
|
"releaseNotes": {
|
||||||
|
"name": null,
|
||||||
|
"text": null,
|
||||||
|
"uri": null
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
},
|
||||||
|
"tasks": [],
|
||||||
|
"inputGroups": {
|
||||||
|
},
|
||||||
|
"incompatibleApps": {
|
||||||
|
},
|
||||||
|
"platformRequirements": {
|
||||||
|
"splunk": {
|
||||||
|
"Enterprise": "*"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,7 @@
|
|||||||
|
# this file is generated by add-on builder automatically
|
||||||
|
# please do not edit it
|
||||||
|
[base]
|
||||||
|
builder_version = 4.1.3
|
||||||
|
builder_build = 0
|
||||||
|
is_edited = 1
|
||||||
|
|
||||||
@ -0,0 +1,30 @@
|
|||||||
|
# this add-on is powered by splunk Add-on builder
|
||||||
|
[install]
|
||||||
|
state_change_requires_restart = false
|
||||||
|
is_configured = 0
|
||||||
|
state = enabled
|
||||||
|
build = 105
|
||||||
|
|
||||||
|
[launcher]
|
||||||
|
author = Netwrix Corporation
|
||||||
|
version = 2.0.0
|
||||||
|
description = Netwrix Threat Manager provides many valuable controls for your IT infrastructure, and has many ways to utilize that data including real-time blocking and alerting. But holistic data reporting requires a more broad reaching platform such as Splunk. This app helps provide insight into the most common activities happening around your Active Directory Learn more about Netwrix at https://www.Netwrix.com/.
|
||||||
|
|
||||||
|
[ui]
|
||||||
|
is_visible = 1
|
||||||
|
label = Netwrix Active Directory and LDAP Monitoring
|
||||||
|
docs_section_override = AddOns:released
|
||||||
|
|
||||||
|
[package]
|
||||||
|
id = stealthbits_ad_ldap
|
||||||
|
|
||||||
|
[triggers]
|
||||||
|
reload.addon_builder = simple
|
||||||
|
reload.stealthbits_ad_ldap_account = simple
|
||||||
|
reload.stealthbits_ad_ldap_settings = simple
|
||||||
|
reload.passwords = simple
|
||||||
|
|
||||||
|
[author=Netwrix]
|
||||||
|
email = splunk@netwrix.com
|
||||||
|
company = Netwrix Corporation
|
||||||
|
|
||||||
@ -0,0 +1,6 @@
|
|||||||
|
<nav color="#D9272D">
|
||||||
|
<view name="page_overview" default="true"/>
|
||||||
|
<view name="page_ad_changes"/>
|
||||||
|
<view name="page_gpo_changes"/>
|
||||||
|
<view name="page_ldap_monitoring"/>
|
||||||
|
</nav>
|
||||||
@ -0,0 +1 @@
|
|||||||
|
Add all the views that your app needs in this directory
|
||||||
@ -0,0 +1,623 @@
|
|||||||
|
<form script="changes.js" stylesheet="changes.css" hideFilters="false" version="1.1">
|
||||||
|
<label>Active Directory Changes</label>
|
||||||
|
<fieldset submitButton="true" autoRun="true">
|
||||||
|
<html>
|
||||||
|
<br/>
|
||||||
|
</html>
|
||||||
|
<input id="eventTime" type="time" token="eventTime" searchWhenChanged="true">
|
||||||
|
<label>Time</label>
|
||||||
|
<default>
|
||||||
|
<earliest>-7d@h</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</default>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="detectingPolicy" searchWhenChanged="false">
|
||||||
|
<label>Detecting Policy</label>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(PolicyName, ".*%.*")
|
||||||
|
| stats sum(PolicyName) by PolicyName
|
||||||
|
| fields - sum(PolicyName)
|
||||||
|
| dedup PolicyName
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>PolicyName</fieldForLabel>
|
||||||
|
<fieldForValue>PolicyName</fieldForValue>
|
||||||
|
<choice value="*">All Policies</choice>
|
||||||
|
<default>*</default>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="actionPerformed" searchWhenChanged="false">
|
||||||
|
<label>Action Performed</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(event_id, ".*%.*") and like(event_id, "%Active Directory%")
|
||||||
|
| stats count by event_id
|
||||||
|
| eval eventID = replace(event_id, "Active Directory ", "")
|
||||||
|
| table eventID
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>eventID</fieldForLabel>
|
||||||
|
<fieldForValue>eventID</fieldForValue>
|
||||||
|
<choice value="*">All Actions</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="actionResult" searchWhenChanged="false">
|
||||||
|
<label>Action Result</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(SuccessfulChange, ".*%.*") and like(event_id, "%Active Directory%")
|
||||||
|
| stats count by SuccessfulChange
|
||||||
|
| eval newSuccessfulChange = case(SuccessfulChange="True", "Successful", SuccessfulChange="False", "Failed")
|
||||||
|
| table newSuccessfulChange, SuccessfulChange
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>newSuccessfulChange</fieldForLabel>
|
||||||
|
<fieldForValue>SuccessfulChange</fieldForValue>
|
||||||
|
<choice value="*">Successful & Failed</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="actionBlocked" searchWhenChanged="false">
|
||||||
|
<label>Action Blocked</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(BlockedEvent, ".*%.*") and like(event_id, "%Active Directory%")
|
||||||
|
| stats sum(BlockedEvent) as BlockedEvent_count by BlockedEvent
|
||||||
|
| eval translated_BlockedEvent=case(BlockedEvent="True", "Yes", BlockedEvent="False", "No")
|
||||||
|
| table translated_BlockedEvent, BlockedEvent
|
||||||
|
| dedup translated_BlockedEvent, BlockedEvent
|
||||||
|
| sort -translated_BlockedEvent, -BlockedEvent
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>translated_BlockedEvent</fieldForLabel>
|
||||||
|
<fieldForValue>BlockedEvent</fieldForValue>
|
||||||
|
<choice value="*">Yes or No</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<html>
|
||||||
|
<br/>
|
||||||
|
</html>
|
||||||
|
<input type="dropdown" token="initiatedDomain" searchWhenChanged="false">
|
||||||
|
<label>Initiated From (Domain)</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(src_nt_domain, ".*%.*") and like(event_id, "%Active Directory%")
|
||||||
|
| stats sum(src_nt_domain) by src_nt_domain
|
||||||
|
| fields - sum(src_nt_domain)
|
||||||
|
| dedup src_nt_domain
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>src_nt_domain</fieldForLabel>
|
||||||
|
<fieldForValue>src_nt_domain</fieldForValue>
|
||||||
|
<choice value="*">All Domains</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="initiatedHost" searchWhenChanged="false">
|
||||||
|
<label>Initiated From (Hostname)</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(Server, ".*%.*") and like(event_id, "%Active Directory%")
|
||||||
|
| stats sum(Server) by Server
|
||||||
|
| eval Server=case(!LIKE(Server, "%\\%"), Server, Server LIKE "%\\%", mvindex(split(Server, "\\"), 1))
|
||||||
|
| fields - sum(Server)
|
||||||
|
| dedup Server
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>Server</fieldForLabel>
|
||||||
|
<fieldForValue>Server</fieldForValue>
|
||||||
|
<choice value="*">All Hosts</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="initiatedUser" searchWhenChanged="false">
|
||||||
|
<label>Initiated By (User)</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(Perpetrator, ".*%.*") and like(event_id, "%Active Directory%")
|
||||||
|
| stats sum(Perpetrator) as Perpetrator_count by Perpetrator
|
||||||
|
| eval Perpetrator=case(!LIKE(Perpetrator, "%\\%"), Perpetrator, Perpetrator LIKE "%\\%", mvindex(split(Perpetrator, "\\"), 1))
|
||||||
|
| eval upper_Perpetrator=upper(substr(Perpetrator,1,1)).substr(Perpetrator,2)
|
||||||
|
| table upper_Perpetrator, Perpetrator
|
||||||
|
| dedup upper_Perpetrator, Perpetrator
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>upper_Perpetrator</fieldForLabel>
|
||||||
|
<fieldForValue>Perpetrator</fieldForValue>
|
||||||
|
<choice value="*">All Users</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="targetDomain" searchWhenChanged="false">
|
||||||
|
<label>Target Domain</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(Domain, ".*%.*")
|
||||||
|
| stats sum(Server) by Domain
|
||||||
|
| fields - sum(Server)
|
||||||
|
| dedup Domain
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>Domain</fieldForLabel>
|
||||||
|
<fieldForValue>Domain</fieldForValue>
|
||||||
|
<choice value="*">All Domains</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="targetObjectType" searchWhenChanged="false">
|
||||||
|
<label>Target Object Type</label>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(ObjectClass, ".*%.*") and like(event_id, "%Active Directory%")
|
||||||
|
| stats sum(ObjectClass) as ObjectClass_count by ObjectClass
|
||||||
|
| eval upper_ObjectClass=upper(substr(ObjectClass,1,1)).substr(ObjectClass,2)
|
||||||
|
| table upper_ObjectClass, ObjectClass
|
||||||
|
| dedup upper_ObjectClass, ObjectClass
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>upper_ObjectClass</fieldForLabel>
|
||||||
|
<fieldForValue>ObjectClass</fieldForValue>
|
||||||
|
<choice value="*">All Object Types</choice>
|
||||||
|
<default>*</default>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="targetObject" searchWhenChanged="false">
|
||||||
|
<label>Target Object</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(ModifiedObject, ".*%.*") and like(event_id, "%Active Directory%")
|
||||||
|
| stats sum(Server) by ModifiedObject
|
||||||
|
| eval ModifiedObject=case(!LIKE(ModifiedObject, "%\\%"), ModifiedObject, ModifiedObject LIKE "%\\%", mvindex(split(ModifiedObject, "\\"), 1))
|
||||||
|
| eval upper_ModifiedObject=upper(substr(ModifiedObject,1,1)).substr(ModifiedObject,2)
|
||||||
|
| table upper_ModifiedObject, ModifiedObject
|
||||||
|
| dedup upper_ModifiedObject, ModifiedObject
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>upper_ModifiedObject</fieldForLabel>
|
||||||
|
<fieldForValue>ModifiedObject</fieldForValue>
|
||||||
|
<choice value="*">All Objects</choice>
|
||||||
|
</input>
|
||||||
|
<html>
|
||||||
|
<div id="options">
|
||||||
|
<a id="hideFilters" data-action="hide-filters" style="margin-left:0">Hide Filters</a>
|
||||||
|
<br/>
|
||||||
|
<a href="../sb_ad_ldap/page_ad_adchanges" style="margin-left:0">Reset Filters</a>
|
||||||
|
</div>
|
||||||
|
</html>
|
||||||
|
</fieldset>
|
||||||
|
<row>
|
||||||
|
<panel>
|
||||||
|
<html>
|
||||||
|
<style>
|
||||||
|
#eventTime {
|
||||||
|
width:200px !important;
|
||||||
|
margin-right:30px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.alert {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.splunk-table {
|
||||||
|
margin:0 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.sorts a {
|
||||||
|
color:#FFFFFF !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.input {
|
||||||
|
margin-top:-23px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#submit {
|
||||||
|
display:none;
|
||||||
|
}
|
||||||
|
|
||||||
|
#options {
|
||||||
|
display:none;
|
||||||
|
}
|
||||||
|
|
||||||
|
.hide-global-filters {
|
||||||
|
display:none;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesRow {
|
||||||
|
max-width:100% !important;
|
||||||
|
margin-top:-2px !important;
|
||||||
|
margin-bottom:10px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
display:none;
|
||||||
|
background:#FFFFFF !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.timestamp {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable th[data-sort-key*='time'],
|
||||||
|
#adChangesTable td[data-cell-index='1'] {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable th[data-sort-key='New Value'] {
|
||||||
|
max-width:150px !important;;
|
||||||
|
overflow:hidden !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable th {
|
||||||
|
background:#364A6F !important;
|
||||||
|
color:#FFFFFF !important;
|
||||||
|
font-size:14px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable td{
|
||||||
|
white-space:nowrap !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesRow {
|
||||||
|
margin-top:-8px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adTransposedRow {
|
||||||
|
margin-top:10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adAttributeRow {
|
||||||
|
margin-top:10px;
|
||||||
|
width:100% !important;
|
||||||
|
max-width:100% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails,
|
||||||
|
#transPerpDetails,
|
||||||
|
#transAffectedObject,
|
||||||
|
#transAgentDetails {
|
||||||
|
height:225px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails table,
|
||||||
|
#transPerpDetails table,
|
||||||
|
#transAffectedObject table,
|
||||||
|
#transAgentDetails table {
|
||||||
|
border:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails tr,
|
||||||
|
#transPerpDetails tr,
|
||||||
|
#transAffectedObject tr,
|
||||||
|
#transAgentDetails tr {
|
||||||
|
border:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails td,
|
||||||
|
#transPerpDetails td,
|
||||||
|
#transAffectedObject td,
|
||||||
|
#transAgentDetails td {
|
||||||
|
border:none !important;
|
||||||
|
padding:5px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
div[id^="transEventDetails"].dashboard-element-header,
|
||||||
|
div[id^="transPerpDetails"].dashboard-element-header,
|
||||||
|
div[id^="transAffectedObject"].dashboard-element-header,
|
||||||
|
div[id^="transAgentDetails"].dashboard-element-header {
|
||||||
|
background:#364A6F !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
div[id^="transEventDetails"].dashboard-element-header h3,
|
||||||
|
div[id^="transPerpDetails"].dashboard-element-header h3,
|
||||||
|
div[id^="transAffectedObject"].dashboard-element-header h3,
|
||||||
|
div[id^="transAgentDetails"].dashboard-element-header h3{
|
||||||
|
color:#FFFFFF !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails thead,
|
||||||
|
#transPerpDetails thead,
|
||||||
|
#transAffectedObject thead,
|
||||||
|
#transAgentDetails thead {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails td[data-cell-index="0"],
|
||||||
|
#transPerpDetails td[data-cell-index="0"],
|
||||||
|
#transAffectedObject td[data-cell-index="0"],
|
||||||
|
#transAgentDetails td[data-cell-index="0"] {
|
||||||
|
width:75px !important;
|
||||||
|
min-width:75px !important;
|
||||||
|
max-width:85px !important;
|
||||||
|
background-color:#FFFFFF !important;
|
||||||
|
font-weight:600 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails td[data-cell-index="1"],
|
||||||
|
#transPerpDetails td[data-cell-index="1"],
|
||||||
|
#transAffectedObject td[data-cell-index="1"],
|
||||||
|
#transAgentDetails td[data-cell-index="1"] {
|
||||||
|
background-color:#FFFFFF !important;
|
||||||
|
width:200px !important;
|
||||||
|
min-width:200px !important;
|
||||||
|
max-width:200px !important;
|
||||||
|
word-wrap: break-word !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable th{
|
||||||
|
margin:0 !important;
|
||||||
|
padding:5px 0 !important;
|
||||||
|
border:1px solid #364A6F !important;
|
||||||
|
font-weight:bold;
|
||||||
|
text-align:center !important;
|
||||||
|
background:#364A6F !important;
|
||||||
|
color:#FFF !important;
|
||||||
|
width:25% !important;
|
||||||
|
max-width:200px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable td{
|
||||||
|
margin:0 !important;
|
||||||
|
padding:15px 15px !important;
|
||||||
|
border:1px solid #364A6F !important;
|
||||||
|
font-size:16px !important;
|
||||||
|
font-weight:400 !important;
|
||||||
|
text-align:center !important;
|
||||||
|
width:25% !important;
|
||||||
|
max-width:200px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable td[data-cell-index="0"],
|
||||||
|
#attributeTable td[data-cell-index="1"] {
|
||||||
|
padding-top:25px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable td[data-cell-index="2"],
|
||||||
|
#attributeTable td[data-cell-index="3"] {
|
||||||
|
overflow-x:scroll !important;
|
||||||
|
overflow-y:hidden !important;
|
||||||
|
}
|
||||||
|
</style>
|
||||||
|
</html>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row id="adChangesRow">
|
||||||
|
<panel>
|
||||||
|
<table id="adChangesTable">
|
||||||
|
<search>
|
||||||
|
<query>`stealthData`
|
||||||
|
| where like(event_id, "%Active Directory%")
|
||||||
|
| eval Time = strftime(_time,"%Y-%m-%d %H:%M%P")
|
||||||
|
| eval EventType = replace(event_id, "Active Directory ", "")
|
||||||
|
| eval InitiatedHost = case(!LIKE(Server, "%\\%"), Server, Server LIKE "%\\%", mvindex(split(Server, "\\"), 1))
|
||||||
|
| eval InitiatedUser = case(!LIKE(Perpetrator, "%\\%"), Perpetrator, Perpetrator LIKE "%\\%", mvindex(split(Perpetrator, "\\"), 1))
|
||||||
|
| eval TargetObject = case(!LIKE(ModifiedObject, "%\\%"), ModifiedObject, ModifiedObject LIKE "%\\%", mvindex(split(ModifiedObject, "\\"), 1))
|
||||||
|
| eval ActionResult = case(SuccessfulChange == "True", "Success", SuccessfulChange == "False", "Failure")
|
||||||
|
| search
|
||||||
|
PolicyName = "$detectingPolicy$"
|
||||||
|
EventType = "$actionPerformed$"
|
||||||
|
SuccessfulChange = "$actionResult$"
|
||||||
|
BlockedEvent = "$actionBlocked$"
|
||||||
|
```src_nt_domain = "$initiatedDomain$"```
|
||||||
|
InitiatedHost = "$initiatedHost$"
|
||||||
|
InitiatedUser = "$initiatedUser$"
|
||||||
|
Domain="$targetDomain$"
|
||||||
|
ObjectClass = "$targetObjectType$"
|
||||||
|
TargetObject = "$targetObject$"
|
||||||
|
| rename
|
||||||
|
Time AS "Event Time"
|
||||||
|
PolicyName AS "Detecting Policy"
|
||||||
|
EventType AS "Action Performed"
|
||||||
|
ActionResult AS "Action Result"
|
||||||
|
BlockedEvent AS "Action Blocked"
|
||||||
|
src_nt_domain AS "Initiating (Domain)"
|
||||||
|
InitiatedHost AS "Initiating (Host)"
|
||||||
|
InitiatedUser AS "Initiating (User)"
|
||||||
|
Domain AS "Target Domain"
|
||||||
|
ObjectClass AS "Target Object Type"
|
||||||
|
TargetObject AS "Target Object"
|
||||||
|
AttributeName AS "Target Attribute"
|
||||||
|
Operation AS "Operation"
|
||||||
|
OldAttributeValue AS "Old Value"
|
||||||
|
NewAttributeValue AS "New Value"
|
||||||
|
| table
|
||||||
|
_time
|
||||||
|
"Event Time"
|
||||||
|
"Detecting Policy"
|
||||||
|
"Action Performed"
|
||||||
|
"Action Result"
|
||||||
|
"Action Blocked"
|
||||||
|
"Initiating (Domain)"
|
||||||
|
"Initiating (Host)"
|
||||||
|
"Initiating (User)"
|
||||||
|
"Target Domain"
|
||||||
|
"Target Object Type"
|
||||||
|
"Target Object"
|
||||||
|
"Target Attribute"
|
||||||
|
"Operation"
|
||||||
|
"Old Value"
|
||||||
|
"New Value"
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">row</option>
|
||||||
|
<option name="count">18</option>
|
||||||
|
<option name="showPager">true</option>
|
||||||
|
<option name="wrap">false</option>
|
||||||
|
<drilldown>
|
||||||
|
<condition field="*">
|
||||||
|
<set token="timeValue">$click.value$</set>
|
||||||
|
</condition>
|
||||||
|
</drilldown>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
|
||||||
|
<row id="adTransposedRow">
|
||||||
|
<panel>
|
||||||
|
<table id="transEventDetails">
|
||||||
|
<title>Event Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| eval EventTime=strftime(_time, "%Y-%m-%d %H:%M:%S")
|
||||||
|
| eval EventTimeUTC=strftime(_time + 18000, "%Y-%m-%d %H:%M:%S")
|
||||||
|
| eval ActionStatus = case(SuccessfulChange == "True", "Success", SuccessfulChange == "False", "Failure")
|
||||||
|
| eval ActionCategory = case(change_type == "AD", "Active Directory")
|
||||||
|
| eval ActionType = replace(event_id, "Active Directory ", "")
|
||||||
|
| rename
|
||||||
|
EventTime AS "Time Logged"
|
||||||
|
EventTimeUTC AS "Time Logged UTC"
|
||||||
|
BlockedEvent AS "Action Blocked"
|
||||||
|
ActionStatus AS "Action Status"
|
||||||
|
ActionCategory AS "Action Category"
|
||||||
|
ActionType AS "Message"
|
||||||
|
| table
|
||||||
|
"Time Logged"
|
||||||
|
"Action Type"
|
||||||
|
"Action Blocked"
|
||||||
|
"Action Status"
|
||||||
|
"Action Category"
|
||||||
|
"Message"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<table id="transPerpDetails" depends="timeValue">
|
||||||
|
<title>Perpetrator Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| rename
|
||||||
|
Perpetrator AS "Account Name"
|
||||||
|
change_type AS "Protocol"
|
||||||
|
Server AS "Host"
|
||||||
|
ServerAddress AS "IP Address"
|
||||||
|
| table
|
||||||
|
"Account Name"
|
||||||
|
"Protocol"
|
||||||
|
"Host"
|
||||||
|
"IP Address"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<table id="transAffectedObject" depends="timeValue">
|
||||||
|
<title>Affected Object Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| rename
|
||||||
|
DistinguishedName AS "Path"
|
||||||
|
ObjectClass AS "Type"
|
||||||
|
CN AS "Name"
|
||||||
|
TargetHost AS "Host"
|
||||||
|
TargetAddress AS "IP Address"
|
||||||
|
| table
|
||||||
|
"Path"
|
||||||
|
"Type"
|
||||||
|
"Name"
|
||||||
|
"Host"
|
||||||
|
"IP Address"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<table id="transAgentDetails" depends="timeValue">
|
||||||
|
<title>Agent Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| rename
|
||||||
|
ClientHost AS "Host"
|
||||||
|
ClientAddress AS "IP Address"
|
||||||
|
| table
|
||||||
|
"Host"
|
||||||
|
"IP Address"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row id="adAttributeRow">
|
||||||
|
<panel>
|
||||||
|
<table id="attributeTable" depends="timeValue">
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| eval EventType = replace(event_id, "Active Directory ", "")
|
||||||
|
| eval EventName = upper(substr(AttributeName, 1, 1)).substr(AttributeName, 2)
|
||||||
|
| rename
|
||||||
|
EventName AS "Attribute Name"
|
||||||
|
EventType AS "Event Type"
|
||||||
|
OldAttributeValue AS "Old Value"
|
||||||
|
NewAttributeValue AS "New Value"
|
||||||
|
| table
|
||||||
|
"Attribute Name"
|
||||||
|
"Event Type"
|
||||||
|
"Old Value"
|
||||||
|
"New Value"
|
||||||
|
| dedup
|
||||||
|
"Attribute Name"
|
||||||
|
"Event Type"
|
||||||
|
"Old Value"
|
||||||
|
"New Value"
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
</form>
|
||||||
@ -0,0 +1,620 @@
|
|||||||
|
<form script="changes.js" stylesheet="changes.css" hideFilters="false" version="1.1">
|
||||||
|
<label>Group Policy Changes</label>
|
||||||
|
<fieldset submitButton="true" autoRun="true">
|
||||||
|
<html>
|
||||||
|
<br/>
|
||||||
|
</html>
|
||||||
|
<input id="eventTime" type="time" token="eventTime" searchWhenChanged="true">
|
||||||
|
<label>Time</label>
|
||||||
|
<default>
|
||||||
|
<earliest>-7d@h</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</default>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="detectingPolicy" searchWhenChanged="false">
|
||||||
|
<label>Detecting Policy</label>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(PolicyName, ".*%.*")
|
||||||
|
| stats sum(PolicyName) by PolicyName
|
||||||
|
| fields - sum(PolicyName)
|
||||||
|
| dedup PolicyName
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>PolicyName</fieldForLabel>
|
||||||
|
<fieldForValue>PolicyName</fieldForValue>
|
||||||
|
<choice value="*">All Policies</choice>
|
||||||
|
<default>*</default>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="actionPerformed" searchWhenChanged="false">
|
||||||
|
<label>Action Performed</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(event_id, ".*%.*") and like(event_id, "%GPO%")
|
||||||
|
| eval EventType = replace(event_id, "SI Events Log ", "")
|
||||||
|
| stats count by EventType
|
||||||
|
| table EventType
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>EventType</fieldForLabel>
|
||||||
|
<fieldForValue>EventType</fieldForValue>
|
||||||
|
<choice value="*">All Actions</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="actionResult" searchWhenChanged="false">
|
||||||
|
<label>Action Result</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(SuccessfulChange, ".*%.*") and like(event_id, "%GPO%")
|
||||||
|
| stats count by SuccessfulChange
|
||||||
|
| eval newSuccessfulChange = case(SuccessfulChange="True", "Successful", SuccessfulChange="False", "Failed")
|
||||||
|
| table newSuccessfulChange, SuccessfulChange
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>newSuccessfulChange</fieldForLabel>
|
||||||
|
<fieldForValue>SuccessfulChange</fieldForValue>
|
||||||
|
<choice value="*">Successful & Failed</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="actionBlocked" searchWhenChanged="false">
|
||||||
|
<label>Action Blocked</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(BlockedEvent, ".*%.*") and like(event_id, "%GPO%")
|
||||||
|
| stats sum(BlockedEvent) as BlockedEvent_count by BlockedEvent
|
||||||
|
| eval translated_BlockedEvent=case(BlockedEvent="True", "Yes", BlockedEvent="False", "No")
|
||||||
|
| table translated_BlockedEvent, BlockedEvent
|
||||||
|
| dedup translated_BlockedEvent, BlockedEvent
|
||||||
|
| sort -translated_BlockedEvent, -BlockedEvent
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>translated_BlockedEvent</fieldForLabel>
|
||||||
|
<fieldForValue>BlockedEvent</fieldForValue>
|
||||||
|
<choice value="*">Yes or No</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<html>
|
||||||
|
<br/>
|
||||||
|
</html>
|
||||||
|
<input type="dropdown" token="initiatedDomain" searchWhenChanged="false">
|
||||||
|
<label>Initiated From (Domain)</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(src_nt_domain, ".*%.*") and like(event_id, "%GPO%")
|
||||||
|
| stats sum(src_nt_domain) by src_nt_domain
|
||||||
|
| fields - sum(src_nt_domain)
|
||||||
|
| dedup src_nt_domain
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>src_nt_domain</fieldForLabel>
|
||||||
|
<fieldForValue>src_nt_domain</fieldForValue>
|
||||||
|
<choice value="*">All Domains</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="initiatedHost" searchWhenChanged="false">
|
||||||
|
<label>Initiated From (Hostname)</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(Server, ".*%.*") and like(event_id, "%GPO%")
|
||||||
|
| stats sum(Server) by Server
|
||||||
|
| eval Server=case(!LIKE(Server, "%\\%"), Server, Server LIKE "%\\%", mvindex(split(Server, "\\"), 1))
|
||||||
|
| fields - sum(Server)
|
||||||
|
| dedup Server
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>Server</fieldForLabel>
|
||||||
|
<fieldForValue>Server</fieldForValue>
|
||||||
|
<choice value="*">All Hosts</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="initiatedUser" searchWhenChanged="false">
|
||||||
|
<label>Initiated By (User)</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(Perpetrator, ".*%.*") and like(event_id, "%GPO%")
|
||||||
|
| stats sum(Perpetrator) as Perpetrator_count by Perpetrator
|
||||||
|
| eval Perpetrator=case(!LIKE(Perpetrator, "%\\%"), Perpetrator, Perpetrator LIKE "%\\%", mvindex(split(Perpetrator, "\\"), 1))
|
||||||
|
| eval upper_Perpetrator=upper(substr(Perpetrator,1,1)).substr(Perpetrator,2)
|
||||||
|
| table upper_Perpetrator, Perpetrator
|
||||||
|
| dedup upper_Perpetrator, Perpetrator
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>upper_Perpetrator</fieldForLabel>
|
||||||
|
<fieldForValue>Perpetrator</fieldForValue>
|
||||||
|
<choice value="*">All Users</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="targetDomain" searchWhenChanged="false">
|
||||||
|
<label>Target Domain</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(Domain, ".*%.*")
|
||||||
|
| stats sum(Server) by Domain
|
||||||
|
| fields - sum(Server)
|
||||||
|
| dedup Domain
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>Domain</fieldForLabel>
|
||||||
|
<fieldForValue>Domain</fieldForValue>
|
||||||
|
<choice value="*">All Domains</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="targetObjectType" searchWhenChanged="false">
|
||||||
|
<label>Target Object Type</label>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(object, ".*%.*") and like(event_id, "%GPO%")
|
||||||
|
| eval AffectedObject = mvindex(split(object, "\\"), -1)
|
||||||
|
| stats count by AffectedObject
|
||||||
|
| table AffectedObject
|
||||||
|
| dedup AffectedObject
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>AffectedObject</fieldForLabel>
|
||||||
|
<fieldForValue>AffectedObject</fieldForValue>
|
||||||
|
<choice value="*">All Object Types</choice>
|
||||||
|
<default>*</default>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="targetObject" searchWhenChanged="false">
|
||||||
|
<label>Target Object</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(AttributeName, ".*%.*") and like(event_id, "%GPO%")
|
||||||
|
| stats count by AttributeName
|
||||||
|
| table AttributeName
|
||||||
|
| dedup AttributeName
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>AttributeName</fieldForLabel>
|
||||||
|
<fieldForValue>AttributeName</fieldForValue>
|
||||||
|
<choice value="*">All Objects</choice>
|
||||||
|
</input>
|
||||||
|
<html>
|
||||||
|
<div id="options">
|
||||||
|
<a id="hideFilters" data-action="hide-filters" style="margin-left:0">Hide Filters</a>
|
||||||
|
<br/>
|
||||||
|
<a href="../sb_ad_ldap/page_ad_adchanges" style="margin-left:0">Reset Filters</a>
|
||||||
|
</div>
|
||||||
|
</html>
|
||||||
|
</fieldset>
|
||||||
|
<row>
|
||||||
|
<panel depends="$alwaysHideCSS$">
|
||||||
|
<html>
|
||||||
|
<style>
|
||||||
|
#eventTime {
|
||||||
|
width:200px !important;
|
||||||
|
margin-right:30px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.alert {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.splunk-table {
|
||||||
|
margin:0 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.sorts a {
|
||||||
|
color:#FFFFFF !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.input {
|
||||||
|
margin-top:-23px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#submit {
|
||||||
|
display:none;
|
||||||
|
}
|
||||||
|
|
||||||
|
#options {
|
||||||
|
display:none;
|
||||||
|
}
|
||||||
|
|
||||||
|
.hide-global-filters {
|
||||||
|
display:none;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesRow {
|
||||||
|
max-width:100% !important;
|
||||||
|
margin-top:-2px !important;
|
||||||
|
margin-bottom:10px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
display:none;
|
||||||
|
background:#FFFFFF !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.timestamp {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable th[data-sort-key*='time'],
|
||||||
|
#adChangesTable td[data-cell-index='1'] {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable th[data-sort-key='New Value'] {
|
||||||
|
max-width:150px !important;;
|
||||||
|
overflow:hidden !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable th {
|
||||||
|
background:#364A6F !important;
|
||||||
|
color:#FFFFFF !important;
|
||||||
|
font-size:14px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable td{
|
||||||
|
white-space:nowrap !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesRow {
|
||||||
|
margin-top:-8px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adTransposedRow {
|
||||||
|
margin-top:10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adAttributeRow {
|
||||||
|
margin-top:10px;
|
||||||
|
width:100% !important;
|
||||||
|
max-width:100% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails,
|
||||||
|
#transPerpDetails,
|
||||||
|
#transAffectedObject,
|
||||||
|
#transAgentDetails {
|
||||||
|
height:225px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails table,
|
||||||
|
#transPerpDetails table,
|
||||||
|
#transAffectedObject table,
|
||||||
|
#transAgentDetails table {
|
||||||
|
border:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails tr,
|
||||||
|
#transPerpDetails tr,
|
||||||
|
#transAffectedObject tr,
|
||||||
|
#transAgentDetails tr {
|
||||||
|
border:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails td,
|
||||||
|
#transPerpDetails td,
|
||||||
|
#transAffectedObject td,
|
||||||
|
#transAgentDetails td {
|
||||||
|
border:none !important;
|
||||||
|
padding:5px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
div[id^="transEventDetails"].dashboard-element-header,
|
||||||
|
div[id^="transPerpDetails"].dashboard-element-header,
|
||||||
|
div[id^="transAffectedObject"].dashboard-element-header,
|
||||||
|
div[id^="transAgentDetails"].dashboard-element-header {
|
||||||
|
background:#364A6F !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
div[id^="transEventDetails"].dashboard-element-header h3,
|
||||||
|
div[id^="transPerpDetails"].dashboard-element-header h3,
|
||||||
|
div[id^="transAffectedObject"].dashboard-element-header h3,
|
||||||
|
div[id^="transAgentDetails"].dashboard-element-header h3{
|
||||||
|
color:#FFFFFF !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails thead,
|
||||||
|
#transPerpDetails thead,
|
||||||
|
#transAffectedObject thead,
|
||||||
|
#transAgentDetails thead {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails td[data-cell-index="0"],
|
||||||
|
#transPerpDetails td[data-cell-index="0"],
|
||||||
|
#transAffectedObject td[data-cell-index="0"],
|
||||||
|
#transAgentDetails td[data-cell-index="0"] {
|
||||||
|
width:75px !important;
|
||||||
|
min-width:75px !important;
|
||||||
|
max-width:85px !important;
|
||||||
|
background-color:#FFFFFF !important;
|
||||||
|
font-weight:600 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails td[data-cell-index="1"],
|
||||||
|
#transPerpDetails td[data-cell-index="1"],
|
||||||
|
#transAffectedObject td[data-cell-index="1"],
|
||||||
|
#transAgentDetails td[data-cell-index="1"] {
|
||||||
|
background-color:#FFFFFF !important;
|
||||||
|
width:200px !important;
|
||||||
|
min-width:200px !important;
|
||||||
|
max-width:200px !important;
|
||||||
|
word-wrap: break-word !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable th{
|
||||||
|
margin:0 !important;
|
||||||
|
padding:5px 0 !important;
|
||||||
|
border:1px solid #364A6F !important;
|
||||||
|
font-weight:bold;
|
||||||
|
text-align:center !important;
|
||||||
|
background:#364A6F !important;
|
||||||
|
color:#FFF !important;
|
||||||
|
width:25% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable td{
|
||||||
|
margin:0 !important;
|
||||||
|
padding:15px 15px !important;
|
||||||
|
border:1px solid #364A6F !important;
|
||||||
|
font-size:16px !important;
|
||||||
|
font-weight:400 !important;
|
||||||
|
text-align:center !important;
|
||||||
|
width:25% !important;
|
||||||
|
}
|
||||||
|
</style>
|
||||||
|
</html>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row id="adChangesRow">
|
||||||
|
<panel>
|
||||||
|
<table id="adChangesTable">
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where like(event_id, "%GPO%")
|
||||||
|
| eval Time = strftime(_time,"%Y-%m-%d %H:%M%P")
|
||||||
|
| eval EventType = replace(event_id, "SI Events Log ", "")
|
||||||
|
| eval InitiatedHost = case(!LIKE(Server, "%\\%"), Server, Server LIKE "%\\%", mvindex(split(Server, "\\"), 1))
|
||||||
|
| eval InitiatedUser = case(!LIKE(Perpetrator, "%\\%"), Perpetrator, Perpetrator LIKE "%\\%", mvindex(split(Perpetrator, "\\"), 1))
|
||||||
|
| eval ActionResult = case(SuccessfulChange == "True", "Success", SuccessfulChange == "False", "Failure")
|
||||||
|
| eval AffectedObject = mvindex(split(object, "\\"), -1)
|
||||||
|
| search
|
||||||
|
PolicyName = "$detectingPolicy$"
|
||||||
|
EventType = "$actionPerformed$"
|
||||||
|
SuccessfulChange = "$actionResult$"
|
||||||
|
BlockedEvent = "$actionBlocked$"
|
||||||
|
src_nt_domain = "$initiatedDomain$"
|
||||||
|
InitiatedHost = "$initiatedHost$"
|
||||||
|
InitiatedUser = "$initiatedUser$"
|
||||||
|
Domain = "$targetDomain$"
|
||||||
|
AffectedObject = "$targetObjectType$"
|
||||||
|
AttributeName = "$targetObject$"
|
||||||
|
| rename
|
||||||
|
Time AS "Event Time"
|
||||||
|
PolicyName AS "Detecting Policy"
|
||||||
|
EventType AS "Action Performed"
|
||||||
|
ActionResult AS "Action Result"
|
||||||
|
BlockedEvent AS "Action Blocked"
|
||||||
|
src_nt_domain AS "Initiating (Domain)"
|
||||||
|
InitiatedHost AS "Initiating (Host)"
|
||||||
|
InitiatedUser AS "Initiating (User)"
|
||||||
|
Domain AS "Target Domain"
|
||||||
|
AffectedObject AS "Target Object Type"
|
||||||
|
AttributeName AS "Target Object"
|
||||||
|
OldAttributeValue AS "Old Value"
|
||||||
|
NewAttributeValue AS "New Value"
|
||||||
|
| table
|
||||||
|
_time
|
||||||
|
"Event Time"
|
||||||
|
"Detecting Policy"
|
||||||
|
"Action Performed"
|
||||||
|
"Action Result"
|
||||||
|
"Action Blocked"
|
||||||
|
"Initiating (Domain)"
|
||||||
|
"Initiating (Host)"
|
||||||
|
"Initiating (User)"
|
||||||
|
"Target Domain"
|
||||||
|
"Target Object Type"
|
||||||
|
"Target Object"
|
||||||
|
"Old Value"
|
||||||
|
"New Value"
|
||||||
|
| dedup
|
||||||
|
_time
|
||||||
|
"Event Time"
|
||||||
|
"Detecting Policy"
|
||||||
|
"Action Performed"
|
||||||
|
"Action Result"
|
||||||
|
"Action Blocked"
|
||||||
|
"Initiating (Domain)"
|
||||||
|
"Initiating (Host)"
|
||||||
|
"Initiating (User)"
|
||||||
|
"Target Domain"
|
||||||
|
"Target Object Type"
|
||||||
|
"Target Object"
|
||||||
|
"Old Value"
|
||||||
|
"New Value"
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">row</option>
|
||||||
|
<option name="count">18</option>
|
||||||
|
<option name="showPager">true</option>
|
||||||
|
<option name="wrap">false</option>
|
||||||
|
<drilldown>
|
||||||
|
<condition field="*">
|
||||||
|
<set token="timeValue">$click.value$</set>
|
||||||
|
</condition>
|
||||||
|
</drilldown>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row id="adTransposedRow">
|
||||||
|
<panel>
|
||||||
|
<table id="transEventDetails" depends="timeValue">
|
||||||
|
<title>Event Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| eval EventTime=strftime(_time, "%Y-%m-%d %H:%M:%S")
|
||||||
|
| eval EventTimeUTC=strftime(_time + 18000, "%Y-%m-%d %H:%M:%S")
|
||||||
|
| eval ActionStatus = case(SuccessfulChange == "True", "Success", SuccessfulChange == "False", "Failure")
|
||||||
|
| eval ActionCategory = case(event_id LIKE "%GPO%", "Group Policy")
|
||||||
|
| eval ActionType = replace(event_id, "SI Events Log ", "")
|
||||||
|
| rename
|
||||||
|
EventTime AS "Time Logged"
|
||||||
|
EventTimeUTC AS "Time Logged UTC"
|
||||||
|
BlockedEvent AS "Action Blocked"
|
||||||
|
ActionStatus AS "Action Status"
|
||||||
|
ActionCategory AS "Action Category"
|
||||||
|
ActionType AS "Message"
|
||||||
|
| table
|
||||||
|
"Time Logged"
|
||||||
|
"Time Logged UTC"
|
||||||
|
"Action Type"
|
||||||
|
"Action Blocked"
|
||||||
|
"Action Status"
|
||||||
|
"Action Category"
|
||||||
|
"Message"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<table id="transPerpDetails" depends="timeValue">
|
||||||
|
<title>Perpetrator Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| rename
|
||||||
|
Perpetrator AS "Account Name"
|
||||||
|
change_type AS "Protocol"
|
||||||
|
Server AS "Host"
|
||||||
|
ServerAddress AS "IP Address"
|
||||||
|
src AS "Access URL"
|
||||||
|
| table
|
||||||
|
"Account Name"
|
||||||
|
"Protocol",
|
||||||
|
"Host",
|
||||||
|
"IP Address",
|
||||||
|
"Access URL"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<table id="transAffectedObject" depends="timeValue">
|
||||||
|
<title>Affected Object Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| rename
|
||||||
|
ObjectClass AS "Type"
|
||||||
|
object AS "Object Path"
|
||||||
|
TargetHost AS "Host"
|
||||||
|
TargetAddress AS "IP Address"
|
||||||
|
| table
|
||||||
|
"Path"
|
||||||
|
"Type",
|
||||||
|
"Account Name",
|
||||||
|
"Object Path",
|
||||||
|
"Host",
|
||||||
|
"IP Address"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<table id="transAgentDetails" depends="timeValue">
|
||||||
|
<title>Agent Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| rename
|
||||||
|
Server AS "Host"
|
||||||
|
ServerAddress AS "IP Address"
|
||||||
|
| table
|
||||||
|
"Host",
|
||||||
|
"IP Address"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row id="adAttributeRow">
|
||||||
|
<panel>
|
||||||
|
<table id="attributeTable" depends="timeValue">
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where _time=$timeValue$
|
||||||
|
| eval EventType = replace(event_id, "SI Events Log ", "")
|
||||||
|
| rename
|
||||||
|
AttributeName AS "Attribute Name"
|
||||||
|
EventType AS "Event Type"
|
||||||
|
OldAttributeValue AS "Old Value"
|
||||||
|
NewAttributeValue AS "New Value"
|
||||||
|
| table
|
||||||
|
"Attribute Name"
|
||||||
|
"Event Type"
|
||||||
|
"Old Value"
|
||||||
|
"New Value"
|
||||||
|
| dedup
|
||||||
|
"Attribute Name"
|
||||||
|
"Event Type"
|
||||||
|
"Old Value"
|
||||||
|
"New Value"
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="count">1</option>
|
||||||
|
<option name="showPager">true</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
</form>
|
||||||
@ -0,0 +1,619 @@
|
|||||||
|
<form script="changes.js" stylesheet="changes.css" hideFilters="false" version="1.1">
|
||||||
|
<label>LDAP Monitoring</label>
|
||||||
|
<fieldset submitButton="true" autoRun="true">
|
||||||
|
<html>
|
||||||
|
<br/>
|
||||||
|
</html>
|
||||||
|
<input id="eventTime" type="time" token="eventTime" searchWhenChanged="true">
|
||||||
|
<label>Time</label>
|
||||||
|
<default>
|
||||||
|
<earliest>-7d@h</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</default>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="detectingPolicy" searchWhenChanged="false">
|
||||||
|
<label>Detecting Policy</label>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(PolicyName, ".*%.*")
|
||||||
|
| stats sum(PolicyName) by PolicyName
|
||||||
|
| fields - sum(PolicyName)
|
||||||
|
| dedup PolicyName
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>PolicyName</fieldForLabel>
|
||||||
|
<fieldForValue>PolicyName</fieldForValue>
|
||||||
|
<choice value="*">All Policies</choice>
|
||||||
|
<default>*</default>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="actionPerformed" searchWhenChanged="false">
|
||||||
|
<label>Action Performed</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(EventName, ".*%.*")
|
||||||
|
| stats count by EventName
|
||||||
|
| table EventName
|
||||||
|
| dedup EventName
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>EventName</fieldForLabel>
|
||||||
|
<fieldForValue>EventName</fieldForValue>
|
||||||
|
<choice value="*">All Actions</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="actionResult" searchWhenChanged="false">
|
||||||
|
<label>Action Result</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(BlockedEvent, ".*%.*")
|
||||||
|
| stats count by BlockedEvent
|
||||||
|
| eval newBlockedEvent = case(BlockedEvent="True", "Failed", BlockedEvent="False", "Successful")
|
||||||
|
| table newBlockedEvent, BlockedEvent
|
||||||
|
| dedup newBlockedEvent, BlockedEvent
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>newBlockedEvent</fieldForLabel>
|
||||||
|
<fieldForValue>BlockedEvent</fieldForValue>
|
||||||
|
<choice value="*">Successful or Failed</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="actionBlocked" searchWhenChanged="false">
|
||||||
|
<label>Action Blocked</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(BlockedEvent, ".*%.*")
|
||||||
|
| stats count by BlockedEvent
|
||||||
|
| eval newBlockedEvent=case(BlockedEvent="True", "Yes", BlockedEvent="False", "No")
|
||||||
|
| table newBlockedEvent, BlockedEvent
|
||||||
|
| dedup newBlockedEvent, BlockedEvent
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>newBlockedEvent</fieldForLabel>
|
||||||
|
<fieldForValue>BlockedEvent</fieldForValue>
|
||||||
|
<choice value="*">Yes or No</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<html>
|
||||||
|
<br/>
|
||||||
|
</html>
|
||||||
|
<input type="dropdown" token="initiatedDomain" searchWhenChanged="false">
|
||||||
|
<label>Initiated From (Domain)</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(DC, ".*%.*")
|
||||||
|
| stats count by DC
|
||||||
|
| fields - count
|
||||||
|
| dedup DC
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>src_nt_domain</fieldForLabel>
|
||||||
|
<fieldForValue>src_nt_domain</fieldForValue>
|
||||||
|
<choice value="*">All Domains</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="initiatedHost" searchWhenChanged="false">
|
||||||
|
<label>Initiated From (Hostname)</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(Server, ".*%.*")
|
||||||
|
| eval Server = case(!LIKE(Server, "%\\%"), Server, Server LIKE "%\\%", mvindex(split(Server, "\\"), 1))
|
||||||
|
| stats count by Server
|
||||||
|
| fields - count
|
||||||
|
| dedup Server
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>Server</fieldForLabel>
|
||||||
|
<fieldForValue>Server</fieldForValue>
|
||||||
|
<choice value="*">All Hosts</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="initiatedUser" searchWhenChanged="false">
|
||||||
|
<label>Initiated By (User)</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(Perpetrator, ".*%.*")
|
||||||
|
| stats sum(Perpetrator) as Perpetrator_count by Perpetrator
|
||||||
|
| eval Perpetrator=case(!LIKE(Perpetrator, "%\\%"), Perpetrator, Perpetrator LIKE "%\\%", mvindex(split(Perpetrator, "\\"), 1))
|
||||||
|
| eval upper_Perpetrator=upper(substr(Perpetrator,1,1)).substr(Perpetrator,2)
|
||||||
|
| table upper_Perpetrator, Perpetrator
|
||||||
|
| dedup upper_Perpetrator, Perpetrator
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>upper_Perpetrator</fieldForLabel>
|
||||||
|
<fieldForValue>Perpetrator</fieldForValue>
|
||||||
|
<choice value="*">All Users</choice>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="accessUrl" searchWhenChanged="false">
|
||||||
|
<label>Access URL</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(AccessURL, ".*%.*")
|
||||||
|
| eval AccessURL = case(AccessURL LIKE "%LDAPS%", replace(AccessURL, "LDAPS:", ""), AccessURL LIKE "%LDAP%", replace(AccessURL, "LDAP:", ""))
|
||||||
|
| stats count by AccessURL
|
||||||
|
| fields - count
|
||||||
|
| dedup AccessURL
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>AccessURL</fieldForLabel>
|
||||||
|
<fieldForValue>AccessURL</fieldForValue>
|
||||||
|
<choice value="*">All Access URLs</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="searchSecure" searchWhenChanged="false">
|
||||||
|
<label>Secure Search</label>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(SecureQuery, ".*%.*")
|
||||||
|
| stats count by SecureQuery
|
||||||
|
| table SecureQuery
|
||||||
|
| dedup SecureQuery
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>SecureQuery</fieldForLabel>
|
||||||
|
<fieldForValue>SecureQuery</fieldForValue>
|
||||||
|
<choice value="*">Yes or No</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<input type="dropdown" token="searchSecurityType" searchWhenChanged="false">
|
||||||
|
<label>Search Security Type</label>
|
||||||
|
<default>*</default>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| where not match(SecurityType, ".*%.*")
|
||||||
|
| stats count by SecurityType
|
||||||
|
| table SecurityType
|
||||||
|
| dedup SecurityType
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<fieldForLabel>SecurityType</fieldForLabel>
|
||||||
|
<fieldForValue>SecurityType</fieldForValue>
|
||||||
|
<choice value="*">All Types</choice>
|
||||||
|
<initialValue>*</initialValue>
|
||||||
|
</input>
|
||||||
|
<html>
|
||||||
|
<div id="options">
|
||||||
|
<a id="hideFilters" data-action="hide-filters" style="margin-left:0">Hide Filters</a>
|
||||||
|
<br/>
|
||||||
|
<a href="../sb_ad_ldap/page_ad_adchanges" style="margin-left:0">Reset Filters</a>
|
||||||
|
</div>
|
||||||
|
</html>
|
||||||
|
</fieldset>
|
||||||
|
<row>
|
||||||
|
<panel depends="$alwaysHideCSS$">
|
||||||
|
<html>
|
||||||
|
<style>
|
||||||
|
#eventTime {
|
||||||
|
width:200px !important;
|
||||||
|
margin-right:30px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.alert {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.splunk-table {
|
||||||
|
margin:0 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.sorts a {
|
||||||
|
color:#FFFFFF !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.timestamp {
|
||||||
|
disply:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.input {
|
||||||
|
margin-top:-23px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#submit {
|
||||||
|
display:none;
|
||||||
|
}
|
||||||
|
|
||||||
|
#options {
|
||||||
|
display:none;
|
||||||
|
}
|
||||||
|
|
||||||
|
.hide-global-filters {
|
||||||
|
display:none;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable th[data-sort-key*='time'],
|
||||||
|
#adChangesTable td[data-cell-index='1'] {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesRow {
|
||||||
|
width:100% !important;
|
||||||
|
max-width:100% !important;
|
||||||
|
margin-top:-2px !important;
|
||||||
|
margin-bottom:10px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable {
|
||||||
|
width:100% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
display:none;
|
||||||
|
background:#FFFFFF !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.timestamp {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable th[data-sort-key='New Value'] {
|
||||||
|
max-width:150px !important;;
|
||||||
|
overflow:hidden !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable th {
|
||||||
|
background:#364A6F !important;
|
||||||
|
color:#FFFFFF !important;
|
||||||
|
font-size:14px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesTable td{
|
||||||
|
white-space:nowrap !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesRow {
|
||||||
|
margin-top:-8px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adTransposedRow {
|
||||||
|
margin-top:10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adAttributeRow {
|
||||||
|
margin-top:10px;
|
||||||
|
width:100% !important;
|
||||||
|
max-width:100% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails,
|
||||||
|
#transPerpDetails,
|
||||||
|
#transAffectedObject,
|
||||||
|
#transAgentDetails {
|
||||||
|
height:225px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails table,
|
||||||
|
#transPerpDetails table,
|
||||||
|
#transAffectedObject table,
|
||||||
|
#transAgentDetails table {
|
||||||
|
border:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails tr,
|
||||||
|
#transPerpDetails tr,
|
||||||
|
#transAffectedObject tr,
|
||||||
|
#transAgentDetails tr {
|
||||||
|
border:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails td,
|
||||||
|
#transPerpDetails td,
|
||||||
|
#transAffectedObject td,
|
||||||
|
#transAgentDetails td {
|
||||||
|
border:none !important;
|
||||||
|
padding:5px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
div[id^="transEventDetails"].dashboard-element-header,
|
||||||
|
div[id^="transPerpDetails"].dashboard-element-header,
|
||||||
|
div[id^="transAffectedObject"].dashboard-element-header,
|
||||||
|
div[id^="transAgentDetails"].dashboard-element-header {
|
||||||
|
background:#364A6F !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
div[id^="transEventDetails"].dashboard-element-header h3,
|
||||||
|
div[id^="transPerpDetails"].dashboard-element-header h3,
|
||||||
|
div[id^="transAffectedObject"].dashboard-element-header h3,
|
||||||
|
div[id^="transAgentDetails"].dashboard-element-header h3{
|
||||||
|
color:#FFFFFF !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails thead,
|
||||||
|
#transPerpDetails thead,
|
||||||
|
#transAffectedObject thead,
|
||||||
|
#transAgentDetails thead {
|
||||||
|
display:none !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails td[data-cell-index="0"],
|
||||||
|
#transPerpDetails td[data-cell-index="0"],
|
||||||
|
#transAffectedObject td[data-cell-index="0"],
|
||||||
|
#transAgentDetails td[data-cell-index="0"] {
|
||||||
|
width:75px !important;
|
||||||
|
min-width:75px !important;
|
||||||
|
max-width:85px !important;
|
||||||
|
background-color:#FFFFFF !important;
|
||||||
|
font-weight:600 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#transEventDetails td[data-cell-index="1"],
|
||||||
|
#transPerpDetails td[data-cell-index="1"],
|
||||||
|
#transAffectedObject td[data-cell-index="1"],
|
||||||
|
#transAgentDetails td[data-cell-index="1"] {
|
||||||
|
background-color:#FFFFFF !important;
|
||||||
|
width:200px !important;
|
||||||
|
min-width:200px !important;
|
||||||
|
max-width:200px !important;
|
||||||
|
word-wrap: break-word !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable th{
|
||||||
|
margin:0 !important;
|
||||||
|
padding:5px 0 !important;
|
||||||
|
border:1px solid #364A6F !important;
|
||||||
|
font-weight:bold;
|
||||||
|
text-align:center !important;
|
||||||
|
background:#364A6F !important;
|
||||||
|
color:#FFF !important;
|
||||||
|
width:25% !important;
|
||||||
|
max-width:200px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable td{
|
||||||
|
margin:0 !important;
|
||||||
|
padding:15px 15px !important;
|
||||||
|
border:1px solid #364A6F !important;
|
||||||
|
font-size:16px !important;
|
||||||
|
font-weight:400 !important;
|
||||||
|
text-align:center !important;
|
||||||
|
width:25% !important;
|
||||||
|
max-width:200px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable td[data-cell-index="0"],
|
||||||
|
#attributeTable td[data-cell-index="1"] {
|
||||||
|
padding-top:25px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#attributeTable td[data-cell-index="2"],
|
||||||
|
#attributeTable td[data-cell-index="3"] {
|
||||||
|
overflow-x:scroll !important;
|
||||||
|
overflow-y:hidden !important;
|
||||||
|
}
|
||||||
|
</style>
|
||||||
|
</html>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row id="adChangesRow">
|
||||||
|
<panel>
|
||||||
|
<table id="adChangesTable">
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| eval Time=strftime(_time,"%Y-%m-%d %H:%M%P")
|
||||||
|
| eval ActionResult = case(BlockedEvent="True", "Failed", BlockedEvent="False", "Successful")
|
||||||
|
| eval BlockedEvent=case(BlockedEvent="True", "Yes", BlockedEvent="False", "No")
|
||||||
|
| eval Server=case(Server LIKE "%\\%", mvindex(split(Server, "\\"), 1))
|
||||||
|
| eval Perpetrator=case(Perpetrator LIKE "%\\%", mvindex(split(Perpetrator, "\\"), 1))
|
||||||
|
| eval AccessURL = case(AccessURL LIKE "%LDAPS%", replace(AccessURL, "LDAPS:", ""), AccessURL LIKE "%LDAP%", replace(AccessURL, "LDAP:", ""))
|
||||||
|
| search
|
||||||
|
PolicyName = "$detectingPolicy$"
|
||||||
|
EventName = "$actionPerformed$"
|
||||||
|
ActionResult = "$actionResult$"
|
||||||
|
BlockedEvent = "$actionBlocked$"
|
||||||
|
DC = "$initiatedDomain$"
|
||||||
|
Server = "$initiatedHost$"
|
||||||
|
Perpetrator = "$initiatedUser$"
|
||||||
|
AccessURL = "$accessUrl$"
|
||||||
|
SecureQuery = "$searchSecure$"
|
||||||
|
SecurityType = "$searchSecurityType$"
|
||||||
|
| rename
|
||||||
|
Time AS "Event Time"
|
||||||
|
PolicyName AS "Detecting Policy"
|
||||||
|
EventName AS "Action Performed"
|
||||||
|
ActionResult AS "Action Result"
|
||||||
|
BlockedEvent AS "Action Blocked"
|
||||||
|
DC AS "Initiating (Domain)"
|
||||||
|
Server AS "Initiating (Host)"
|
||||||
|
Perpetrator AS "Initiating (User)"
|
||||||
|
AccessURL AS "Access URL"
|
||||||
|
SecureQuery AS "Secure Query"
|
||||||
|
SecurityType AS "Security Type"
|
||||||
|
QueryFilter AS "Query Filter"
|
||||||
|
| table
|
||||||
|
_time
|
||||||
|
"Event Time"
|
||||||
|
"Detecting Policy"
|
||||||
|
"Action Performed"
|
||||||
|
"Action Result"
|
||||||
|
"Action Blocked"
|
||||||
|
"Initiating (Domain)"
|
||||||
|
"Initiating (Host)"
|
||||||
|
"Initiating (User)"
|
||||||
|
"Access URL"
|
||||||
|
"Secure Query"
|
||||||
|
"Security Type"
|
||||||
|
"Query Filter"
|
||||||
|
| dedup
|
||||||
|
_time
|
||||||
|
"Event Time"
|
||||||
|
"Detecting Policy"
|
||||||
|
"Action Performed"
|
||||||
|
"Action Result"
|
||||||
|
"Action Blocked"
|
||||||
|
"Initiating (Domain)"
|
||||||
|
"Initiating (Host)"
|
||||||
|
"Initiating (User)"
|
||||||
|
"Access URL"
|
||||||
|
"Secure Query"
|
||||||
|
"Security Type"
|
||||||
|
"Query Filter"
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">row</option>
|
||||||
|
<option name="count">18</option>
|
||||||
|
<option name="showPager">true</option>
|
||||||
|
<option name="wrap">false</option>
|
||||||
|
<drilldown>
|
||||||
|
<condition field="*">
|
||||||
|
<set token="time_token">$click.value$</set>
|
||||||
|
</condition>
|
||||||
|
</drilldown>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row id="adTransposedRow">
|
||||||
|
<panel>
|
||||||
|
<table id="transEventDetails" depends="time_token">
|
||||||
|
<title>Event Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
AND _time="$time_token$"
|
||||||
|
| eval EventTime=strftime(_time, "%Y-%m-%d %H:%M:%S")
|
||||||
|
| eval EventTimeUTC=strftime(_time+18000, "%Y-%m-%d %H:%M:%S")
|
||||||
|
| eval ActionStatus = case(BlockedEvent="True", "Failed", BlockedEvent="False", "Successful")
|
||||||
|
| rename
|
||||||
|
EventTime AS "Time Logged",
|
||||||
|
EventTimeUTC AS "Time Logged UTC",
|
||||||
|
EventName AS "Action Type",
|
||||||
|
BlockedEvent AS "Action Blocked",
|
||||||
|
actionStatus AS "Action Status",
|
||||||
|
event_id AS "Message"
|
||||||
|
| table
|
||||||
|
"Time Logged",
|
||||||
|
"Time Logged UTC"
|
||||||
|
"Action Type",
|
||||||
|
"Action Blocked",
|
||||||
|
"Action Status",
|
||||||
|
"Message"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<table id="transPerpDetails" depends="time_token">
|
||||||
|
<title>Perpetrator Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
AND _time="$time_token$"
|
||||||
|
| rename
|
||||||
|
Perpetrator AS "Account Name"
|
||||||
|
PerpetratorSID AS "Account SID"
|
||||||
|
DistinguishedName AS "Account DN"
|
||||||
|
Server AS "Host"
|
||||||
|
ServerAddress AS "IP Address"
|
||||||
|
AccessURL AS "Access URL"
|
||||||
|
| table
|
||||||
|
"Account Name"
|
||||||
|
"Account SID",
|
||||||
|
"Account DN"
|
||||||
|
"Protocol",
|
||||||
|
"Client Host",
|
||||||
|
"Client IP Address",
|
||||||
|
"Access URL"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<table id="transAffectedObject" depends="time_token">
|
||||||
|
<title>Search Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
AND _time="$time_token$"
|
||||||
|
| rename
|
||||||
|
QueryFilter AS "Query Filter"
|
||||||
|
QueryExecutionTimeAvg AS "Query Execute Time"
|
||||||
|
ObjectsReturned AS "Result Count"
|
||||||
|
SecurityQuery AS "Secure Query"
|
||||||
|
SecurityType AS "Security Type"
|
||||||
|
| table
|
||||||
|
"Query Filter"
|
||||||
|
"Query Execute Time"
|
||||||
|
"Result Count"
|
||||||
|
"Secure Query"
|
||||||
|
"Security Type"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<table id="transAgentDetails" depends="time_token">
|
||||||
|
<title>Agent Details</title>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
AND _time="$time_token$"
|
||||||
|
| rename
|
||||||
|
ClientHost AS "Host"
|
||||||
|
ClientAddress AS "IP Address"
|
||||||
|
| table
|
||||||
|
"Host",
|
||||||
|
"IP Address"
|
||||||
|
| transpose 1
|
||||||
|
</query>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">none</option>
|
||||||
|
<option name="showPager">false</option>
|
||||||
|
</table>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
</form>
|
||||||
@ -0,0 +1,689 @@
|
|||||||
|
<form stylesheet="overview.css" version="1.1">
|
||||||
|
<label>Dashboard</label>
|
||||||
|
<fieldset submitButton="false" autoRun="true">
|
||||||
|
<input type="time" token="eventTime" searchWhenChanged="true">
|
||||||
|
<label></label>
|
||||||
|
<default>
|
||||||
|
<earliest>-7d@h</earliest>
|
||||||
|
<latest>now</latest>
|
||||||
|
</default>
|
||||||
|
</input>
|
||||||
|
</fieldset>
|
||||||
|
<row>
|
||||||
|
<panel depends="$alwaysHideCSS$">
|
||||||
|
<html>
|
||||||
|
<style>
|
||||||
|
body div.main-section-body.dashboard-body {
|
||||||
|
background:#F2F4F5 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
.dashboard-layout-panel {
|
||||||
|
cursor:pointer !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adMostActiveUsers {
|
||||||
|
width:48.50% !important;
|
||||||
|
padding-right:1.50%;
|
||||||
|
}
|
||||||
|
|
||||||
|
#gpoMostActiveUsers {
|
||||||
|
width:48.50% !important;
|
||||||
|
padding-left:1.50%;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adChangesValue{
|
||||||
|
position:relative !important;
|
||||||
|
margin-top:20% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adEventTypes {
|
||||||
|
width:15.50% !important;
|
||||||
|
padding-right:1% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adEventResult {
|
||||||
|
width:15.50% !important;
|
||||||
|
padding-right:1% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adEventBlocked {
|
||||||
|
width:15.50% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#gpoEventTypes {
|
||||||
|
width:15.50% !important;
|
||||||
|
padding-right:1% !important;
|
||||||
|
padding-left:3% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#gpoEventResult {
|
||||||
|
width:15.50% !important;
|
||||||
|
padding-right:1% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#gpoEventBlocked {
|
||||||
|
width:15.50% !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#overview {
|
||||||
|
background:#F2F4F5 !important;
|
||||||
|
padding:0 !important;
|
||||||
|
margin-bottom:-20px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#adtitle {
|
||||||
|
background:#F2F4F5 !important;
|
||||||
|
padding:0 !important;
|
||||||
|
margin-bottom:-20px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#gpotitle {
|
||||||
|
background:#F2F4F5 !important;
|
||||||
|
padding:0 !important;
|
||||||
|
margin-bottom:-20px !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
#ldaptitle {
|
||||||
|
background:#F2F4F5 !important;
|
||||||
|
padding:0 !important;
|
||||||
|
margin-bottom:-25px !important;
|
||||||
|
}
|
||||||
|
</style>
|
||||||
|
</html>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row>
|
||||||
|
<panel>
|
||||||
|
<html id="overview">
|
||||||
|
<h2 style="position:relative; left:-5px;">
|
||||||
|
<b>Overview</b>
|
||||||
|
</h2>
|
||||||
|
</html>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row>
|
||||||
|
<panel id="adEvents">
|
||||||
|
<title>Active Directory Events</title>
|
||||||
|
<single>
|
||||||
|
<search depends="eventTime">
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where like(event_id, "Active Directory%")
|
||||||
|
| stats count
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<drilldown>
|
||||||
|
<condition>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ad_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$]]>
|
||||||
|
</link>
|
||||||
|
</condition>
|
||||||
|
</drilldown>
|
||||||
|
</single>
|
||||||
|
</panel>
|
||||||
|
<panel id="gpoEvents">
|
||||||
|
<title>Group Policy Events</title>
|
||||||
|
<single depends="eventTime">
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where like(event_id, "%GPO%")
|
||||||
|
| stats count
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<drilldown>
|
||||||
|
<condition>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_gpo_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$]]>
|
||||||
|
</link>
|
||||||
|
</condition>
|
||||||
|
</drilldown>
|
||||||
|
</single>
|
||||||
|
</panel>
|
||||||
|
<panel id="ldapEvents">
|
||||||
|
<title>LDAP Events</title>
|
||||||
|
<single depends="eventTime">
|
||||||
|
<search>
|
||||||
|
<query>`stealthData` Protocol = "LDAP"
|
||||||
|
| stats count</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="drilldown">all</option>
|
||||||
|
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
|
||||||
|
<option name="refresh.display">progressbar</option>
|
||||||
|
<drilldown>
|
||||||
|
<condition>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ldap_monitoring?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$]]>
|
||||||
|
</link>
|
||||||
|
</condition>
|
||||||
|
</drilldown>
|
||||||
|
</single>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<title>Active Users</title>
|
||||||
|
<single depends="eventTime">
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where !like(Perpetrator, '*\%*')
|
||||||
|
| stats dc(Perpetrator) as count
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
</single>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<title>Monitored Domains</title>
|
||||||
|
<single depends="eventTime">
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(Domain, ".*%.*")
|
||||||
|
| stats dc(Domain) as count
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
</single>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row>
|
||||||
|
<panel>
|
||||||
|
<title>Events Over Time</title>
|
||||||
|
<chart depends="eventTime">
|
||||||
|
<search>
|
||||||
|
<query>`stealthData`
|
||||||
|
| where like(event_id, "%GPO%") OR like(event_id, "Active Directory%") OR like(Protocol, "%LDAP%")
|
||||||
|
| eval eventID = replace(event_id, "Active Directory ", "")
|
||||||
|
| timechart sum(linecount) as "Event Count" by eventID</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">line</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">right</option>
|
||||||
|
<option name="refresh.display">progressbar</option>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row>
|
||||||
|
<panel>
|
||||||
|
<html id="adtitle">
|
||||||
|
<h2 style="position:relative; left:-5px;">
|
||||||
|
<b>Active Directory Events</b>
|
||||||
|
</h2>
|
||||||
|
</html>
|
||||||
|
</panel>
|
||||||
|
<panel>
|
||||||
|
<html id="gpotitle">
|
||||||
|
<h2 style="position:relative; left:2.50%;">
|
||||||
|
<b>Group Policy Events</b>
|
||||||
|
</h2>
|
||||||
|
</html>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row>
|
||||||
|
<panel id="adMostActiveUsers">
|
||||||
|
<title>AD Most Active Users</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where like(event_id, "Active Directory%")
|
||||||
|
| eval eventID = replace(event_id, "Active Directory ", "")
|
||||||
|
| chart count BY Perpetrator eventID
|
||||||
|
| addtotals
|
||||||
|
| sort -Total, +Perpetrator
|
||||||
|
| head 5
|
||||||
|
| fields - Total
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">bar</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.chart.showDataLabels">none</option>
|
||||||
|
<option name="charting.chart.stackMode">stacked</option>
|
||||||
|
<option name="charting.legend.placement">right</option>
|
||||||
|
<option name="refresh.display">progressbar</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedDomain">mvindex(split($click.value$, "\\"), 0)</eval>
|
||||||
|
<eval token="clickedUser">mvindex(split($click.value$, "\\"), 1)</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ad_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.initiatedDomain=$clickedDomain$&form.initiatedUser=$clickedUser$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="gpoMostActiveUsers">
|
||||||
|
<title>GPO Most Active Users</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where like(event_id, "%GPO%")
|
||||||
|
| stats count BY Perpetrator
|
||||||
|
| rename count as "Event Count"
|
||||||
|
| sort -"Event Count"
|
||||||
|
| head 5
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">bar</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedDomain">mvindex(split($click.value$, "\\"), 0)</eval>
|
||||||
|
<eval token="clickedUser">mvindex(split($click.value$, "\\"), 1)</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_gpo_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.initiatedDomain=$clickedDomain$&form.initiatedUser=$clickedUser$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row>
|
||||||
|
<panel id="adEventTypes">
|
||||||
|
<title>AD Events By Type</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(event_id, ".*%.*") and like(event_id, "%Active Directory%")
|
||||||
|
| eval eventID = replace(event_id, "Active Directory ", "")
|
||||||
|
| stats count by eventID
|
||||||
|
| eval percent=round(percent)
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ad_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.actionPerformed=$click.value$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="adEventResult">
|
||||||
|
<title>AD Successful/Failed Changes</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where like(event_id, "Active Directory%")
|
||||||
|
| stats count BY SuccessfulChange
|
||||||
|
| replace False WITH "Failed", True WITH "Successful" IN SuccessfulChange
|
||||||
|
| eval percent=round(percent)
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedResult">case($click.value$ == "Successful", "True", $click.value$ == "Failed", "False")</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ad_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.actionResult=$clickedResult$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="adEventBlocked">
|
||||||
|
<title>AD Allowed/Blocked Changes</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where like(event_id, "Active Directory%")
|
||||||
|
| stats count BY BlockedEvent
|
||||||
|
| replace False WITH "Allowed", True WITH "Blocked" IN BlockedEvent
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedBlocked">case($click.value$ == "Allowed", "False", $click.value$ != "Allowed", "True")</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ad_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.actionBlocked=$clickedBlocked$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="gpoEventTypes">
|
||||||
|
<title>GPO Events By Type</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where not match(event_id, ".*%.*") and like(event_id, "%GPO%")
|
||||||
|
| eval eventID = replace(event_id, "SI Events Log ", "")
|
||||||
|
| stats count by eventID
|
||||||
|
| eval percent=round(percent)
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_gpo_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.actionPerformed=$click.value$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="gpoEventResult">
|
||||||
|
<title>GPO Successful/Failed Changes</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where like(event_id, "%GPO%")
|
||||||
|
| stats count BY SuccessfulChange
|
||||||
|
| replace False WITH "Failed", True WITH "Successful" IN SuccessfulChange
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedResult">case($click.value$ == "Successful", "True", $click.value$ == "Failed", "False")</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ad_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.actionResult=$clickedResult$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="gpoEventBlocked">
|
||||||
|
<title>GPO Allowed/Blocked Changes</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
| where like(event_id, "%GPO%")
|
||||||
|
| stats count BY BlockedEvent
|
||||||
|
| replace False WITH "Allowed", True WITH "Blocked" IN BlockedEvent
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedBlocked">case($click.value$ == "Allowed", "False", $click.value$ != "Allowed", "True")</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_gpo_changes?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.actionBlocked=$clickedBlocked$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row>
|
||||||
|
<panel>
|
||||||
|
<html id="ldaptitle">
|
||||||
|
<div>
|
||||||
|
<h2 style="position:relative; top:-10px; left:-5px;">
|
||||||
|
<b>LDAP Events</b>
|
||||||
|
</h2>
|
||||||
|
</div>
|
||||||
|
</html>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row>
|
||||||
|
<panel id="ldapMostActiveHosts">
|
||||||
|
<title>LDAP Most Active Source Hosts</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| stats count BY Server
|
||||||
|
| rename count as "Event Count"
|
||||||
|
| sort -"Event Count"
|
||||||
|
| head 5
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">bar</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedDomain">mvindex(split($click.value$, "\\"), 0)</eval>
|
||||||
|
<eval token="clickedHost">mvindex(split($click.value$, "\\"), 1)</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ldap_monitoring?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.initiatedDomain=$clickedDomain$&form.initiatedHost=$clickedHost$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="ldapMostActiveUrls">
|
||||||
|
<title>LDAP Most Active Access URLs</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| eval AccessURL = replace(AccessURL, "LDAP:", "")
|
||||||
|
| stats count BY AccessURL
|
||||||
|
| sort - count
|
||||||
|
| head 5
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">bar</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ldap_monitoring?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.accessUrl=$click.value$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="ldapMostActiveUsers">
|
||||||
|
<title>LDAP Most Active Users</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| stats count BY Perpetrator
|
||||||
|
| sort - count
|
||||||
|
| head 5
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">bar</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedDomain">mvindex(split($click.value$, "\\"), 0)</eval>
|
||||||
|
<eval token="clickedUser">mvindex(split($click.value$, "\\"), 1)</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ldap_monitoring?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.initiatedDomain=$clickedDomain$&form.initiatedUser=$clickedUser$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
<row>
|
||||||
|
<panel id="ldapPiePanel1">
|
||||||
|
<title>LDAP Events By Type</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| stats count BY EventName
|
||||||
|
| eval percent=round(percent)
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ldap_monitoring?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.actionPerformed=$click.value$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="ldapBlocked">
|
||||||
|
<title>LDAP Allowed/Blocked Queries</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| stats count BY BlockedEvent
|
||||||
|
| replace False WITH "Allowed", True WITH "Blocked" IN BlockedEvent
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedBlocked">case($click.value$ == "Allowed", "No", $click.value$ != "Allowed", "Yes")</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ldap_monitoring?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.actionBlocked=$clickedBlocked$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="ldapLdaps">
|
||||||
|
<title>LDAPS vs. LDAP</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| stats count BY SecureQuery
|
||||||
|
| replace No WITH "LDAP", Yes WITH "LDAPS" IN SecureQuery
|
||||||
|
| eval percent=round(percent)
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedSecure">case($click.value$ == "LDAPS", "Yes", $click.value$ == "LDAP", "No")</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ldap_monitoring?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.searchSecure=$clickedSecure$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="ldapSignedSealed">
|
||||||
|
<title>Signed and Sealed vs. LDAP</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| stats count BY SecurityType
|
||||||
|
| replace None WITH "LDAP", "Add Random Data" WITH "LDAP" IN SecurityType
|
||||||
|
| eval percent=round(percent)
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedSecurityType">case($click.value$ == "LDAP", "None", $click.value$ != "LDAP", $click.value$)</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ldap_monitoring?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.searchSecurityType=$clickedSecurityType$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
<panel id="ldapSecure">
|
||||||
|
<title>Secure vs. Insecure</title>
|
||||||
|
<chart>
|
||||||
|
<search>
|
||||||
|
<query>
|
||||||
|
`stealthData`
|
||||||
|
Protocol = "LDAP"
|
||||||
|
| stats count BY SecureQuery
|
||||||
|
| replace No WITH "Unsecure", Yes WITH "Secure" IN SecureQuery
|
||||||
|
| eval percent=round(percent)
|
||||||
|
</query>
|
||||||
|
<earliest>$eventTime.earliest$</earliest>
|
||||||
|
<latest>$eventTime.latest$</latest>
|
||||||
|
</search>
|
||||||
|
<option name="charting.axisTitleX.visibility">collapsed</option>
|
||||||
|
<option name="charting.axisTitleY.visibility">collapsed</option>
|
||||||
|
<option name="charting.chart">pie</option>
|
||||||
|
<option name="charting.chart.nullValueMode">zero</option>
|
||||||
|
<option name="charting.legend.placement">none</option>
|
||||||
|
<drilldown>
|
||||||
|
<eval token="clickedSecure">case($click.value$ == "Secure", "Yes", $click.value$ == "Unsecure", "No")</eval>
|
||||||
|
<link>
|
||||||
|
<![CDATA[/app/sb_ad_ldap/page_ldap_monitoring?form.eventTime.earliest=$eventTime.earliest$&form.eventTime.latest=$eventTime.latest$&form.searchSecure=$clickedSecure$]]>
|
||||||
|
</link>
|
||||||
|
</drilldown>
|
||||||
|
</chart>
|
||||||
|
</panel>
|
||||||
|
</row>
|
||||||
|
</form>
|
||||||
@ -0,0 +1,11 @@
|
|||||||
|
[StealthINTERCEPT_Authentication]
|
||||||
|
priority = 5
|
||||||
|
search = `stealthData` event_id="Authentication Auth *"
|
||||||
|
|
||||||
|
[StealthINTERCEPT_Active_Directory]
|
||||||
|
priority = 5
|
||||||
|
search = `stealthData` event_id="Active Directory*"
|
||||||
|
|
||||||
|
[StealthINTERCEPT_Group_Policy]
|
||||||
|
priority = 5
|
||||||
|
search = `stealthData` event_id="*GPO*"
|
||||||
@ -0,0 +1,3 @@
|
|||||||
|
[stealthData]
|
||||||
|
definition = index=* (sourcetype=STEALTHbits OR sourcetype=StealthINTERCEPT)
|
||||||
|
iseval = 0
|
||||||
@ -0,0 +1,21 @@
|
|||||||
|
[StealthINTERCEPT]
|
||||||
|
EVAL-action = case(like(event_id, "%Password _hanged"), "updated", like(event_id, "%Object _odified"), "modified", like(event_id, "%Object _dded"), "created", like(event_id, "%Group Members _dded"), "modified", like(event_id, "%Account _nabled"), "updated", like(event_id, "%Object _eleted"), "deleted", like(event_id, "%Group Members _emoved"), "modified", like(event_id, "%Account _nlocked"), "unlocked", like(event_id, "%Account _isabled"), "updated", like(event_id, "%_ock%"), "lockout")
|
||||||
|
EVAL-change_type = case(like(event_id, "Active Directory%"), "AD", like(event_id, "%File%"), "filesystem")
|
||||||
|
EVAL-dvc = coalesce(Server,ServerAddress)
|
||||||
|
EVAL-dest = coalesce(TargetHost, TargetHostIP, Server, ServerAddress)
|
||||||
|
EVAL-src = coalesce(ClientHost, ClientAddress)
|
||||||
|
EVAL-status = case(SuccessfulChange == "True", "success", SuccessfulChange == "False", "failure")
|
||||||
|
EVAL-vendor_product = "STEALTHbits StealthINTERCEPT"
|
||||||
|
EXTRACT-event_id = [STEALTHbits Activity Monitor|StealthINTERCEPT] - (?P<event_id>[^\-]+)\s\-
|
||||||
|
FIELDALIAS-CIM: Authentication = AttributeName AS object_attrs DistinguishedName AS object Domain AS src_nt_domain ObjectClass AS object_category Perpetrator AS user _time AS file_access_time result AS status event_id AS EventName
|
||||||
|
|
||||||
|
[STEALTHbits]
|
||||||
|
EVAL-action = case(like(event_id, "%Password _hanged"), "updated", like(event_id, "%Object _odified"), "modified", like(event_id, "%Object _dded"), "created", like(event_id, "%Group Members _dded"), "modified", like(event_id, "%Account _nabled"), "updated", like(event_id, "%Object _eleted"), "deleted", like(event_id, "%Group Members _emoved"), "modified", like(event_id, "%Account _nlocked"), "unlocked", like(event_id, "%Account _isabled"), "updated", like(event_id, "%_ock%"), "lockout")
|
||||||
|
EVAL-change_type = case(like(event_id, "Active Directory%"), "AD", like(event_id, "%File%"), "filesystem")
|
||||||
|
EVAL-dvc = coalesce(Server,ServerAddress)
|
||||||
|
EVAL-dest = coalesce(TargetHost, TargetHostIP, Server, ServerAddress)
|
||||||
|
EVAL-src = coalesce(ClientHost, ClientAddress)
|
||||||
|
EVAL-status = case(SuccessfulChange == "True", "success", SuccessfulChange == "False", "failure")
|
||||||
|
EVAL-vendor_product = "STEALTHbits StealthINTERCEPT"
|
||||||
|
EXTRACT-event_id = [STEALTHbits Activity Monitor|StealthINTERCEPT] - (?P<event_id>[^\-]+)\s\-
|
||||||
|
FIELDALIAS-CIM: Authentication = AttributeName AS object_attrs DistinguishedName AS object Domain AS src_nt_domain ObjectClass AS object_category Perpetrator AS user _time AS file_access_time result AS status event_id AS EventName
|
||||||
@ -0,0 +1,9 @@
|
|||||||
|
[eventtype=StealthINTERCEPT%20Active%20Directory]
|
||||||
|
change = enabled
|
||||||
|
|
||||||
|
[eventtype=StealthINTERCEPT%20Authentication]
|
||||||
|
change = enabled
|
||||||
|
authentication = enabled
|
||||||
|
|
||||||
|
[eventtype=StealthINTERCEPT%20Group%20Policy]
|
||||||
|
change = enabled
|
||||||
@ -0,0 +1,8 @@
|
|||||||
|
|
||||||
|
[]
|
||||||
|
access = read : [ * ], write : [ admin ]
|
||||||
|
export = system
|
||||||
|
|
||||||
|
[views]
|
||||||
|
access = read : [ * ], write : [ admin ]
|
||||||
|
export = none
|
||||||
|
After Width: | Height: | Size: 1.3 KiB |
|
After Width: | Height: | Size: 1.4 KiB |
|
After Width: | Height: | Size: 1.7 KiB |
|
After Width: | Height: | Size: 1.7 KiB |
|
After Width: | Height: | Size: 12 KiB |
|
After Width: | Height: | Size: 5.3 KiB |
|
After Width: | Height: | Size: 40 KiB |
File diff suppressed because one or more lines are too long
Loading…
Reference in new issue