diff --git a/apps/eventid/README.txt b/apps/eventid/README.txt new file mode 100644 index 00000000..fb601609 --- /dev/null +++ b/apps/eventid/README.txt @@ -0,0 +1,14 @@ +Windows Event Log Analysis Splunk App version 1.5.1 +Copyright (C) 2016-2018 Adrian Grigorof All Rights Reserved. + +The Windows Event Log Analysis Splunk App assumes that Splunk is collecting information from Windows servers and workstation via the Universal Forwarder, the local Windows event log collector or remotely via WMI. +It analyzes the entries from indexes matching the "index="wineventlog" OR source=*WinEventLog*" criteria. This matches the defaults used by the Universal Forwarder, the collection of local Windows event logs and the collection via WMI. +To collect the logs from remote computers without installing the Universal Forwarded on each computer, configure the forwarding of event logs to central location using the Windows built-in event forwarding. +The Interesting Processes section from the Processes dashboard is partially based on a presentation by Michael Gough from www.malwarearchaeology.com: "The Top 10 Windows Event ID's Used To Catch Hackers In The Act". See https://www.malwarearchaeology.com/home/2016/5/7/windows-top-10-event-logs-from-my-dell-enterprise-security-summit-talk for the presentation slides and information on how to enable the auditing of processes, including command-line based ones. The list of “interesting processes” is based on a study by JPCERT CC (Japan Computer Emergency Response Team Coordination Center) on detecting lateral movement through tracking of event logs (https://www.jpcert.or.jp/english/pub/sr/ir_research.html). The list is stored in C:\Program Files\Splunk\etc\apps\eventid\lookups\interesting_processes.csv and it can be adjusted with a text editor if needed. +If not data is displayed, please verify that the Universal Forwarder is installed properly and that the all the Windows event logs are sent to the "wineventlog" index (or the WinEventLog* sources). + +See Configure Computers to Forward and Collect Events (https://msdn.microsoft.com/en-us/library/cc748890(v=ws.11).aspx) for details on how to configure a computer as a collector of logs. + +Send any suggestions, questions etc. to adigrio@gmail.com or support@altairtech.ca. + +For up-to-date documentation, see: https://www.eventid.net/splunk_addon.asp diff --git a/apps/eventid/appserver/static/appIcon.png b/apps/eventid/appserver/static/appIcon.png new file mode 100644 index 00000000..5b9c7e92 Binary files /dev/null and b/apps/eventid/appserver/static/appIcon.png differ diff --git a/apps/eventid/appserver/static/appIcon_2x.png b/apps/eventid/appserver/static/appIcon_2x.png new file mode 100644 index 00000000..2fa23aa1 Binary files /dev/null and b/apps/eventid/appserver/static/appIcon_2x.png differ diff --git a/apps/eventid/appserver/static/application.css b/apps/eventid/appserver/static/application.css new file mode 100644 index 00000000..595a77da --- /dev/null +++ b/apps/eventid/appserver/static/application.css @@ -0,0 +1,553 @@ +body { + background-color: #cedec3; + font-size: 12px; + line-height: 130%; +} + +ul.accountBarItems { + font-size: 11px; +} + +br { + clear: both; +} + +.SplunkModule { + padding: 0px; +} + +.appHeaderWrapper { + background-color: #333333; + background-image: none; +} + +#appContent h1 { + font-size: 24px; + font-weight: normal; + letter-spacing: -1px; + line-height: 130%; + margin-bottom: 15px; + text-shadow: white 0px 1px 1px; +} + +.splButton-primary span, +.splButton-secondary span, +.splButton-tertiary span { + min-width: 110px; +} + +.resultsArea { + background-color: #EDEDE7; +} + +/** app tabs **/ +div.appTabsWrapperOuter { + background: #333 url(./images/bg_tabs.png) repeat-x 50% 100%; +} + +div.appTabsWrapper { + margin: 0px auto 0px; + width: 830px; + overflow: hidden; +} + +/* Target Firefox 2 and older [!] */ +div.appTabsWrapper ul#appTabs, x:-moz-any-link { + position: relative; + top: 1px; +} + +div.appTabsWrapper ul#appTabs, x:-moz-any-link, x:default { + position: relative; + top: 0px; +} + +div.appTabsWrapper ul#appTabs { + list-style-type: none; + margin: 15px 0px 0px; + overflow: hidden; + padding: 0px; + width: 100%; +} + +div.appTabsWrapper ul#appTabs li { + float: left; + list-style-type: none; + margin: 0px 5px 0px 0px; +} + +div.appTabsWrapper ul#appTabs li a { + background-color: #73A550; + -moz-border-radius-topleft: 5px; + -moz-border-radius-topright: 5px; + -webkit-border-top-left-radius: 5px; + -webkit-border-top-right-radius: 5px; + border-top-left-radius: 5px; + border-top-right-radius: 5px; + color: white; + display: block; + font-size: 14px; + padding: 8px 20px; + text-decoration: none; + -moz-text-shadow: #666 0px 1px 1px; + -webkit-text-shadow: #666 0px 1px 1px; + text-shadow: #666 0px 1px 1px; +} + +div.appTabsWrapper ul#appTabs li.current a { + background-color: #EDEDE7; + color: #333; + text-shadow: white 0px 1px 1px; + border: 1px solid white; + border-bottom: none; +} + +div.launcherContent { + margin: 15px auto; + width: 830px; +} + +div.launcherList { + float: left; + width: 549px; +} + +/** launcher links **/ +ul.launcherLinks { +/* -webkit-box-shadow: #DDD 0px 0px 5px; */ + border: 0px; + margin: 0px 0px 0px -25px; + list-style-type: none; + position: relative; +} + +ul.launcherLinks li { + /* background-color: white; */ + xxborder-bottom: 1px solid #edede7; + xxcolor: #666; + /* padding: 15px; */ + position: relative; + z-index: 200; + zoom: 1; + _line-height: 0px; + _font-size: 1%; +} + +ul.launcherLinks li .launcherApplistBackground { + cursor: pointer; +} + +li.launcherMsg { + background-color: white; + margin-left: 25px; +} + +ul.launcherLinks li.launcherMsg p { + padding: 0px; + _font-size: 12px; +} + +li.launcherMsg .launcherMsgUpdate { + background: transparent url(images/icon_update.png) 0px 0px no-repeat; + _background-image: url(images/icon_update_ie6.png); + padding-left: 20px; +} + +li.launcherMsg .launcherMsgSetup { + background: transparent url(images/icon_setup.png) 0px 0px no-repeat; + _background: transparent url(images/icon_setup_ie6.png) 0px 0px no-repeat; + padding-left: 20px; +} + +ul.launcherLinks li.first div.launcherApplistBackground { + -moz-border-radius-topleft: 5px; + -moz-border-radius-topright: 5px; + -webkit-border-top-left-radius: 5px; + -webkit-border-top-right-radius: 5px; + border-top-left-radius: 5px; + border-top-right-radius: 5px; +} + +ul.launcherLinks li.last div.launcherApplistBackground { + -moz-border-radius-bottomleft: 5px; + -moz-border-radius-bottomright: 5px; + -webkit-border-bottom-left-radius: 5px; + -webkit-border-bottom-right-radius: 5px; + border-bottom-left-radius: 5px; + border-bottom-right-radius: 5px; + border-bottom: none; +} + +ul.launcherLinks li:hover { + xxbackground: #fff url(images/bg_gradient_100.png) repeat-x; +} + +ul.launcherLinks li div { + background-repeat: no-repeat; + min-height: 50px; + xxpadding: 0px 0px 0px 46px; + xxmargin-left: -20px; +} + +.appicon { + width: 36px; + height: 36px; + padding: 5px; +} + +ul.launcherLinks li div.launcher-applist-wrapper, +ul.launcherLinks li div.launcherApplistBackground { + _font-size: 12px; + _line-height: 130%; +} + +ul.launcherLinks li.datainputs div.launcherApplistIcon { + background-image:url(images/icon_addData.png); + background-position: 10px 10px; +} + +ul.launcherLinks li.search div.launcherApplistIcon { + background-image:url(images/searchIcon.png); + background-position: 10px 10px; +} + + +ul.launcherLinks li a { + font-size: 16px; +} + +ul.launcherLinks li a:hover { + text-decoration: none; + _text-decoration: underline; +} + +ul.launcherLinks p { + color: #666; + line-height: 130%; + margin: 0px; + padding-top: 5px; +} + +/** launcher messages **/ +ul.launcherLinks li.launcherMsg { + border-bottom: 1px solid #EEE; + cursor: text; + padding: 5px 15px; + -webkit-border-top-left-radius: 5px; + -webkit-border-top-right-radius: 5px; + -moz-border-radius-topleft: 5px; + -moz-border-radius-topright: 5px; + border-top-left-radius: 5px; + border-top-right-radius: 5px; +} + +ul.launcherLinks li.launcherMsg a { + color: red; + display: inline-block; + text-decoration: underline; + font-size: 12px; + line-height: 130%; +} + +/** launcher app list **/ +ul.launcherLinks ul.launcherAppsList { + margin: 0px; + padding: 0px; + list-style: none; + z-index: 200; + position: relative; + *font-size: 1%; +} + +li.launcherShadow { + -webkit-box-shadow: #DDD 0px 0px 5px; + -moz-box-shadow: #DDD 0px 0px 5px; + box-shadow: #DDD 0px 0px 5px; + + -webkit-border-radius: 5px; + -moz-border-radius: 5px; + border-radius: 5px; + z-index: 2 !important; + position: absolute !important; + height: 356px; + width: 529px; + top: 0px; + left: 25px; +} + +/* Firefox 2 hacks for list border */ +li.launcherShadow, x:-moz-any-link { + top: -1px; + left: 24px; + border: 1px solid #CCC; +} + +/* Firefox 3+ hacks for list border */ +li.launcherShadow, x:-moz-any-link, x:default { + top: 0px; + left: 25px; + border: none; +} + +/* Firefox 3.0 - 3.5 hacks for list border */ +body.firefox3 li.launcherShadow { + top: -1px; + left: 24px; + border: 1px solid #CCC; +} + +/* IE 8 and below hacks for list border */ +li.launcherShadow { + border: 1px solid #CCC\9; + top: -1px\9; + left: 24px\9; +} + +/* IE 6 hack */ +#home li.launcherShadow { + _left: -1px; +} + +/** launcher reorder handle **/ +ul.launcherLinks li div.reorderHandle { + position: absolute; + display: block; + background-color: white; + background-image: url("images/icon_reorderHandler.png") !important; + _background-image: url("images/icon_reorderHandler_ie6.png") !important; + background-position: 8px 5px; + left: 0px; + top: 5px; + width: 20px; + height: 20px; + padding: 1px 0px 1px 5px; + -moz-border-radius-topleft: 5px; + -moz-border-radius-bottomleft: 5px; + -webkit-border-top-left-radius: 5px; + -webkit-border-bottom-left-radius: 5px; + border-top-left-radius: 5px; + border-bottom-left-radius: 5px; + min-height: 0px !important; +} + +/* Firefox 2 hacks for reorder handle borders */ +ul.launcherLinks li div.reorderHandle, x:-moz-any-link { + border: 1px solid #CCC; + border-right: none; + left: -1px; +} + +/* Firefox 3+ hacks for reorder handle border */ +ul.launcherLinks li div.reorderHandle, x:default { + border: none; + left: 0px; +} + +/* Firefox 3.0 - 3.5 hacks for reorder handle borders */ +body.firefox3 ul.launcherLinks li div.reorderHandle { + border: 1px solid #CCC; + border-right: none; + left: -1px; +} + +/* IE 8 and below hacks for reorder handle borders */ +ul.launcherLinks li div.reorderHandle { + border: 1px solid #CCC\9; + border-right: none\9; + left: -1px\9; +} + +ul.launcherLinks div.launcherApplistBackground { + margin-left: 25px; + background-color: white; + border-bottom: 1px solid #edede7; + zoom: 1; +} +ul.launcherLinks div.launcherApplistIcon { + padding: 10px; +} + +ul.launcherLinks div.launcherApplistDesc { + margin-left: 45px; + *font-size: 12px; +} + +ul.launcherLinks div.launcherApplistBackground:hover { + background: #fff url(images/bg_gradient_100.png) repeat-x bottom; +} +ul.launcherLinks .disabledApp div.launcherApplistBackground:hover { + background-image: none; +} +ul.launcherLinks li div.reorderHandle:hover { + cursor: move; + background-position: 8px -15px; +} + +/** enable/set up buttons **/ +ul.launcherLinks .setupApp button { + background-color: #BBB; + border: 1px solid #999; +} + +ul.launcherLinks .setupApp button:hover { + border-color: #666; +} + +ul.launcherLinks li.disabledApp button, +ul.launcherLinks li.setupApp button { + position: absolute; + top: 5px; + right: 7px; + height: 23px; + line-height: 20px; + background-position: left -5px; + padding: 0px 10px; +} + +ul.launcherLinks li.disabledApp button span, +ul.launcherLinks li.setupApp button span { + min-width: 0; + line-height: 100%; +} + +ul.launcherLinks li.disabledApp:hover { + background-image: none; +} + +ul.launcherLinks li.disabledApp button:hover { + border-color: #000; +} + +ul.launcherLinks .disabledApp, +ul.launcherLinks .disabledApp a { + cursor: text; +} +ul.launcherLinks .disabledApp .launcher-applist-wrapper { + opacity: 0.6; +} + +ul.launcherLinks .disabledApp p { + color: #333; +} + +/** launchersidebar **/ +div.launchersidebar { + float: left; + margin-left: 30px; + width: 250px; + border: none; +} + +div.section { + -moz-border-radius: 5px; + -webkit-border-radius: 5px; + border-radius: 5px; + -moz-box-shadow: 0 0 5px #DDD; + -webkit-box-shadow: #DDD 0 0 5px; + -moz-box-shadow: #DDD 0 0 5px; + -webkit-box-shadow: #DDD 0 0 5px; + box-shadow: #DDD 0 0 5px; + background: none repeat scroll 0 0 #E5F2F5; + margin-bottom: 10px; + padding: 15px; + border: 1px solid #CCC; +} + +h2, +div.launchersidebar h2 { + color: #333; + font-size: 16px; + font-weight: normal; + margin: 0px; + padding: 0px; + padding-bottom: 10px; + text-shadow: 0 1px 1px white; +} + +div.launchersidebar ul { + margin: 0px 5px; + list-style: none; +} + +div.launchersidebar ul li { + padding: 5px 0px; +} + +/** spotlight section **/ +div.launchersidebar div.spotlight { + background-color: #666; + -moz-box-shadow: 0 0 5px #555 inset; + -webkit-box-shadow: 0 0 5px #555 inset; + box-shadow: 0 0 5px #555 inset; + border: 1px solid #555; +} + +div.launchersidebar div.spotlight h2 { + color: white; + text-shadow: 0px 1px 1px #333; +} + +div.launchersidebar div.spotlight button.splButton-primary { + margin: 5px; + background-color: #77AA44; +} + +div.launchersidebar div.spotlight button.splButton-primary:hover { + background-color: #693; +} + + +/* IE 6 doesn't recognize min_width */ +div.launchersidebar div.spotlight button span { + _width: 110px; +} + +/** icons for launchersidebar links **/ +.apps { + background: url("images/icon_apps.png") no-repeat; + padding-left: 20px; +} + +.tutorial { + background: url("images/icon_tutorial.png") no-repeat; + padding-left: 20px; +} + +.whatsNew { + background: url("images/icon_mail.png") no-repeat; + padding-left: 20px; +} + +.splunkDoc { + background: url("images/icon_file.png") no-repeat; + padding-left: 20px; +} + +.searches { + background: url("images/icon_document.png") no-repeat; + padding-left: 20px; +} + +.more { + background: url("images/icon_circle_add.png") no-repeat; + padding-left: 20px; +} + +.answers { + background: url("images/icon_ask.png") no-repeat; + padding-left: 20px; +} + +/** footer **/ +div.divider { + margin-top: 20px; + width: 100%; + border-bottom: 1px solid #DDD; +} + +div.launcherFooter { + padding-top: 10px; + border-top: 1px solid #FFF; + color: #666; + text-shadow: 0px 1px 1px white; +} diff --git a/apps/eventid/appserver/static/dashboard.css b/apps/eventid/appserver/static/dashboard.css new file mode 100644 index 00000000..299cace5 --- /dev/null +++ b/apps/eventid/appserver/static/dashboard.css @@ -0,0 +1,78 @@ + +/* Set background */ +.main-section-body { + background-color:#cedec3; + background-image:-webkit-gradient(linear, 0 0, 0 100%, from(#e2e9eb), color-stop(400px, #cedec3), to(#cedec3)); + background-image:-webkit-linear-gradient(#e2e9eb, #cedec3 400px, #cedec3); + background-image:-moz-linear-gradient(top, #e2e9eb, #cedec3 400px, #cedec3); + background-image:-o-linear-gradient(#e2e9eb, #cedec3 400px, #cedec3); + background-image:linear-gradient(#e2e9eb, #cedec3 400px, #cedec3); + filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffe2e9eb', endColorstr='#ffcedec3', GradientType=0); +} + +/* Make the forms look like they are in a panel */ +/*.fieldset { + border-radius: 4px; + border: 1px solid #cccccc; + background: white; + margin: 0 0px 10px 0; + box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.08); + position: relative; + padding: 12px 15px 0px 15px; +} + +.fieldset .hide-label { +} +*/ + +/* Shrink the form text inputs */ +/* Removed because Splunk 6.1 spaces the fields differently */ +/*input, textarea, .uneditable-input { + width: 120px; +}*/ + +/* Make the Search button on each dashboard blue instead of green */ + +.btn-primary { + background-color: #5c9732; + background-image: -moz-linear-gradient(top, #0087df, #004f82); + background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#0087df), to(#004f82)); + background-image: -webkit-linear-gradient(top, #0087df, #004f82); + background-image: -o-linear-gradient(top, #0087df, #004f82); + background-image: linear-gradient(to bottom, #0087df, #004f82); + background-repeat: repeat-x; + filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff0087df', endColorstr='#ff004f82', GradientType=0); + background-color: #0087df; + border: 1px solid #143ab1; + border-bottom-color: #0048c9; + border-top-color: #004f82; + color: #ffffff; + text-shadow: 0 -1px 0 rgba(51, 51, 51, 0.7); + -webkit-box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.08); + -moz-box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.08); + box-shadow: 0px 1px 1px rgba(0, 0, 0, 0.08); +} + +.btn-primary:hover { + background-color: #7db44d; + background-image: -moz-linear-gradient(top, #6ac1fa, #007fd1); + background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#6ac1fa), to(#007fd1)); + background-image: -webkit-linear-gradient(top, #6ac1fa, #007fd1); + background-image: -o-linear-gradient(top, #6ac1fa, #007fd1); + background-image: linear-gradient(to bottom, #6ac1fa, #007fd1); + background-repeat: repeat-x; + filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff6ac1fa', endColorstr='#ff007fd1', GradientType=0); + background-color: #389ddf; + border-color: #0c89db; + border-bottom-color: #006eb4; + border-top-color: #3f99d3; + background-position: 0 0; +} + +.btn-primary:active, .btn-primary.active { + background-color: #016baf 9; +} +.btn-primary:hover, .btn-primary:focus, .btn-primary:active, .btn-primary.active, .btn-primary.disabled, .btn-primary[disabled] { + color: #ffffff; + background-color: #016baf; +} diff --git a/apps/eventid/appserver/static/dashboard.js b/apps/eventid/appserver/static/dashboard.js new file mode 100644 index 00000000..2d47c545 --- /dev/null +++ b/apps/eventid/appserver/static/dashboard.js @@ -0,0 +1,1128 @@ +//we listen to the jobResurrected event (triggered in Splunk.Search.resurrect()) +//and because it passes the containing group title of the module resurrecting the job, +//we are able to map the job.getCreateTime() values into 'last refreshed:' header for each panel. + +Splunk.DashboardManager = $.klass({ + dateDict : {}, + NOW_REFRESHED_TIME : _("real-time"), + TODAY_REFRESHED_TIME : _("today at %(timeText)s."), + GENERIC_REFRESHED_TIME : _("%(dateText)s ago"), + FULL_REFRESHED_TIME : _("refreshed: %(dateText)s"), + DISPLAY_REFLOW_EVENT: 'Splunk.Events.REDRAW', + PANEL_DROP_EVENT: 'Splunk.Events.PANEL_DROP', + windowWidth: $(window).width(), +// windowHeight: $(window).height(), + + initialize: function() { + // handlers to keep the last refreshed headers updated. + $(document).bind('jobResurrected', this.onJobExists.bind(this)); + $(document).bind('jobDispatched', this.onJobExists.bind(this)); + $(document).bind('jobProgress', this.onJobProgress.bind(this)); + + var that = this; + + // setup the headers to auto-truncate long titles + this.titleHeaders = $('.layoutCell .splHeader h2'); + this.handlePanelResize(); + + var timeoutID = null; + + $(window).bind('resize', function() { + if ( $(window).width() != that.windowWidth /*|| $(window).height() != that.windowHeight*/ ) { + that.windowWidth = $(window).width(); +// that.windowHeight = $(window).height(); + + if ( timeoutID ) + window.clearTimeout(that.timeoutID); + + timeoutID = window.setTimeout(function(){ + $(window).trigger("real_resize"); + }, 100); + } + }); + + $(window).bind('real_resize', this.handlePanelResize.bind(this)); +// $(document).bind('Splunk.Events.REDRAW', this.handlePanelResize.bind(this)); + $(document).bind('allModulesLoaded', this.handlePanelResize.bind(this)); + $(document).bind('jobDone', function(){ + if(!this.editMode) { + setTimeout(this.equalizeHeights, 500); + } + }.bind(this)); + + // custom event fired by chart modules when they are resized manually by the user + $(document).bind('ChartManualResize', this.handlePanelResize.bind(this)); + + $(document).bind('RefreshPage', this.softRefresh.bind(this)); +// $(window).bind('resize', function(){DebugUtils.trace("window.resize invoked")}); +// $(window).bind('real_resize', function(){DebugUtils.trace("window.real_resize invoked")}); +// $(document).bind('Splunk.Events.REDRAW', function(){DebugUtils.trace("Splunk.Events.REDRAW invoked")}); +// $(document).bind('allModulesLoaded', function(){DebugUtils.trace("allModulesLoaded invoked")}); +// $(document).bind('jobDone', function(){DebugUtils.trace("jobDone invoked")}); +// $(document).bind('ChartManualResize', function(){DebugUtils.trace("ChartManualResize invoked")}); + + + $(document).bind('PrintStart', this.insertPageBreakers.bind(this)); + $(document).bind('PrintEnd', this.removePageBreakers.bind(this)); + + this.searchIdToGroupNames = {}; + this.panelRowsSelector = 'div.layoutRow[class*="panel_row"]'; +// this.panelRowsSelector = 'div.layoutRow[class="panel_row*"]'; + this.$panelRows = $(this.panelRowsSelector); + + this.$isAwesomeBrowser = ! ($.browser.msie && $.browser.version < 9); + + // DebugUtils.trace( this.panelRowsSelector); + + //do equal heights + this.equalizeHeights(); + + var dragAndDropEnabled = false; + if ( Splunk.ViewConfig && ! ($.browser.msie && $.browser.version == 6) && 0 == $(".FlashWrapperContainer").length ) { + dragAndDropEnabled = (Splunk.ViewConfig.view.nativeObjectMode == "SimpleDashboard") && Splunk.ViewConfig.view.canWrite && ! Splunk.ViewConfig.view.hasRowGrouping; + } + + this.editMode = false; + $(document).bind('Splunk.Module.DashboardTitleBar.editMode', function(event, enabled){ + var $paneledit = $('.paneledit'); + + if (enabled) { + $paneledit.show(); + if(dragAndDropEnabled) { + that.dragAndDropControllerInit(); + that.editMode = true; + } + } else { + $paneledit.hide(); + if(dragAndDropEnabled) { + that.dragAndDropControllerDestroy(); + that.editMode = false; + } + } + }.bind(this)); + + that.panelEditInit(); + + //setup panel editor and focus model + this.messenger = Splunk.Messenger.System.getInstance(); + }, + + /** + * Reloads the existing page preserving old search jobs if they are present via the + * fragment identifier. + * + * @param {String} excludeGimpId (Optional) An optional gimpId to exclude form the soft-refresh (forces job refresh) + */ + softRefresh: function(excludeGimpId) { + var frag = {}; //Splunk.util.queryStringToProp(Splunk.util.getHash()); + var gimps = $('.Gimp'); + for (var i = 0; i < gimps.length; i++) { + var gimpId = gimps[i].id; + if (gimpId==excludeGimpId) { + continue; + } + var gimpModule = Splunk.Globals['ModuleLoader'].getModuleInstanceById(gimpId); + var search = gimpModule.getContext().get("search"); + + if (!search || !search.job) continue; + + var sid = search.job.getSearchId(); + + if (!sid) continue; + + var meta = gimpModule.container.closest('.dashboardCell').find('.paneledit').attr("data-sequence"); + frag['panel_' + meta + ".sid"] = sid; + search.job.setAsAutoCancellable(false); + } + + frag['edit'] = 1; + window.location.hash = Splunk.util.propToQueryString(frag); + window.location.reload(); + }, + + // iterate on all the panels besides the one clicked on, and remove the menu. + // since this is a draggable object, the events are not propagating to the top and document.click is never triggered. + // we could manually trigger a dummy event, or a doc.click event, besides IE is garbage and it is throwing a weird error when we do so. + menusGC: function(orig){ + var that = this; + $('.paneledit').each(function(){ + if (this != orig){ + that.hideMenu(this.actionsMenu); + } + }); + }, + + hideMenu: function(menu){ + if (menu) { + menu.getMenu().remove(); + menu = null; + } + }, + + panelEditInit: function() { + var that = this; + + $('.paneledit').click(function(event) { + + that.menusGC(this); + + // since events are not being propagated, we have to manually hide our menu item if it is in a visible mode. + if (this.actionsMenu && this.actionsMenu.getMenu().is(':visible')) { + that.hideMenu(this.actionsMenu); + event.stopImmediatePropagation(); + return false; + } + + // remove the previous menu, since our id could have been changed. + that.hideMenu(this.actionsMenu); + + var meta = $(this);//.parent(); + + var sequence = meta.attr('data-sequence'); + var intersectX = meta.attr('data-intersect-x'); + var intersectY = meta.attr('data-intersect-y'); + var dashboardId = meta.attr('data-dashboard-id'); + var app = meta.attr('data-app'); + var panelType = meta.attr('data-paneltype'); + var id = $($('.Gimp')[sequence]).attr('id'); + + var gimpModule = Splunk.Globals['ModuleLoader'].getModuleInstanceById(id); + //shallow object of k/v pairs adapted for panel editor + var panelSettings = gimpModule.getPanelSettings(panelType, 'options.'); + + + panelSettings.id = dashboardId; + panelSettings.panelType = panelType; + panelSettings.enable_fragment_id = 0; + panelSettings.enable_controls = 1; + + + + //search meta data + var context = null, search = null, job = null; + context = gimpModule.getContext(); + if (context) search = context.get('search'); + if (search) job = search.job; + + if (!job || job.areResultsTransformed()) + panelSettings.is_transforming = true; + else + panelSettings.is_transforming = false; + + //set the href to the panel editor + var editVisualizationHref = Splunk.util.make_url('paneleditor', app, 'edit', intersectX, intersectY)+ '?' + Splunk.util.propToQueryString(panelSettings); + + + + var menuDict = [ + { + label: _("Edit search"), + uri: Splunk.util.make_url('paneleditor', app, 'searchedit', intersectX, intersectY) + '?id=' + encodeURIComponent(dashboardId), + callback: function(event) { + $(document).trigger('SessionTimeout.Jobber'); + that.showExpose(id); + var options = { + onBeforeDestroy: function() { + //restart the jobber + $(document).trigger('SessionStart.Jobber'); + $(".dashboardCellEditable").removeClass("dashboardCellActive"); + that.hideExpose(); + }, + onFrameLoad: function(popup, iframe) { + $(document).bind('panelsave', function() { + popup.destroyPopup(); + that.softRefresh(id); + }); + }, + isModal: false, + pclass: 'panelEditorPopup' + }; + Splunk.Popup.IFramer(event.target.href, _("Edit search"), options); + return false; + } + }, + { + label: _("Edit visualization"), + uri: editVisualizationHref, + callback: function(event) { + $(document).trigger('SessionTimeout.Jobber'); + //panel meta found on + //gimp module lookup + var id = $($('.Gimp')[sequence]).attr('id'); + that.showExpose(id); + var options = { + onBeforeDestroy: function() { + //restart the jobber + $(document).trigger('SessionStart.Jobber'); + $(".dashboardCellEditable").removeClass("dashboardCellActive"); + that.hideExpose(); + }, + onFrameLoad: function(popup, iframe) { + $(document).bind('panelsave', function() { + popup.destroyPopup(); + that.softRefresh(id); + }); + }, + isModal: false, + pclass: 'panelEditorPopup' + }; + Splunk.Popup.IFramer(event.target.href, _("Edit visualization"), options); + return false; + } + }, + { + label: _("Delete"), + uri: '', + callback: function(event) { + that.showExpose(id); + setTimeout(function(){ + var deletePanel = confirm(_('Are you sure you would like to delete this panel?')); + that.hideExpose(); + if (deletePanel) { + var url = Splunk.util.make_url('paneleditor', app, 'delete', intersectX, intersectY)+ '?' + Splunk.util.propToQueryString({id: dashboardId}); + $.ajax({ + url: url, + type: 'POST', + timeout: 10000, + complete: function(jqXHR, textStatus) { + if (jqXHR.status==204) { + //delete node beacuse we are going to reset sequence + meta.closest('.layoutCell').remove(); + that.resetSequence(); + that.softRefresh(id); + } else { + alert(_('Sorry, the specified panel could not be deleted.')); + } + } + }); + } + }, 600); + return false; + } + } + ]; + this.actionsMenu = new Splunk.MenuBuilder({ + menuDict: menuDict, + activator: (that.$isAwesomeBrowser ? meta : meta.parent()), + menuClasses: 'splMenu-primary' + }); + this.actionsMenu.showMenu(); + return false; + }); + }, + + panelRowsAddOverlayLayers: function(doBind) { + + var that = this; + that.isDNDEditMode = doBind; + + if(doBind) { + $(window).unbind("real_resize", doAddOverlays); + $(window).bind("real_resize", doAddOverlays); + doAddOverlays(); + } + + + function doAddOverlays(e) { + + if ( ! that.isDNDEditMode ) { + return ; + } + + var start = DebugUtils.getCurrfentTime(); + + var mySelection = $(that.panelRowsSelector); + mySelection.find(".vmPanelDropPlaceholderOverlay").remove(); + + // reset z-index since IE is dumb. + if ( ! that.$isAwesomeBrowser ) { + mySelection.children().css({"z-index": "1"}); + } + + mySelection.find(".layoutCellInner").each(function(){ + var overlayNode = $(document.createElement("div")).addClass("layoutCellInner vmPanelDropPlaceholderOverlay"); + $(this).after(overlayNode); + var ieThingy = 25; + + var height = ($(this).parent().height()); + if( ! that.$isAwesomeBrowser ) + height -= ieThingy; + + height += "px"; + + var top = that.$isAwesomeBrowser ? "0" : ieThingy+"px"; + bindAttributes(overlayNode, ($(this).parent().width() - 15) + "px", height, top); + + + if ( ! that.$isAwesomeBrowser ) { + overlayNode = $(document.createElement("div")).addClass("layoutCellInner vmPanelDropPlaceholderOverlay"); + $(this).after(overlayNode); + bindAttributes(overlayNode, ($(this).parent().width() - 100) + "px", ieThingy + "px", 0); + } + }); + + + function bindAttributes(element, width, height, top) { + element.css({ + 'width': width, + 'height': height, + 'z-index': 2, +// 'background-color': 'red', + 'top': top + }).bind({ + mouseover: function(){ + var selection = $(this).parent().children().first(); + selection.find(".dashboardContent, .splHeader").css("opacity", "0.6"); + }, + mouseout: function(){ + that.dragAndDropMouseOut($(this).parent().children().first()); + } + }); + } + + DebugUtils.trace( "doAddOverlays", start) ; + + } + + }, + + dragAndDropMouseOut: function (selection) { + if (selection) { + selection.find(".dashboardContent, .splHeader").css("opacity", "1.0"); + } + else { + this.dragAndDropMouseOut($(this.panelRowsSelector).find('.layoutCellInner')); + } + }, + + dragAndDropControllerInit: function() { + + var that = this; + + var maxHeight = 250; + var newRowHeight = 20; + + var sortableParameters = { + connectWith: that.panelRowsSelector, + placeholder: 'vmPanelDropPlaceholder', + opacity: 0.7, + tolerance: 'pointer', + cursor: 'move', + delay: 100, + cursorAt: { top: (maxHeight / 2) }, + handle: '.vmPanelDropPlaceholderOverlay' + }; + + //help IE get out of class early + if(! this.$isAwesomeBrowser){ + sortableParameters.helper = function(){ + return $('
'); + }; + sortableParameters.opacity = 1; + } + + $('.splLastRefreshed').hide(); + + $(that.panelRowsSelector).fadeOut('fast', function(){$(this).fadeIn('fast');}); + + + // FIXME hide the "move panels" button + // this should be removed from the template once the feature is stable + $(".editmode > .splButton-tertiary.move").hide(); + + + _removeEmptyRows(); + + // set max height + var selector = $(that.panelRowsSelector); + + selector.find(".layoutCell").css({"max-height": (maxHeight + "px")/*, "overflow": "hidden"*/}); + selector.find(".layoutCellInner").css({"min-height": "0", "max-height": ((maxHeight - 10) + "px"), "overflow": "hidden"}); + selector.find(".dashboardContent").css({"max-height": ((maxHeight - 60) + "px"), "overflow": "hidden"}); + + that.panelRowsAddOverlayLayers(true); + + _generateEmptyRows(false); + + that.changeChartFlow(); + + /** END COMMANDS - METHODS START HERE */ + + + function _bindEvents() { + + var myRowSelection = $(that.panelRowsSelector); + + myRowSelection.unbind('sortstart'); + myRowSelection.unbind('sortactivate'); + myRowSelection.unbind('sortover'); + myRowSelection.unbind('sortstop'); + + myRowSelection.bind( "sortstart", _sortableStart ); + myRowSelection.bind( "sortactivate", _sortableActivate ); + myRowSelection.bind( "sortover", _sortableOver ); + myRowSelection.bind( "sortstop", _sortableStop ); + } + + + function _sortableStart(event, ui) { + $('.vmPanelDropPlaceholder').css("height", Math.floor( $(ui.item).height() - 15) + 'px' ); //TODO: this seems hacky + $('.vmPanelDropPlaceholder').css("width", Math.floor($(ui.item).width() - 25) + 'px'); + } + + function _sortableActivate(event, ui) { +// var start = DebugUtils.getCurrfentTime(); + + if( ! (this === ui.item.parent()[0]) ) { + if ( $(this).children().length > 2 ) { // disable rows that has 3 panels - this is a UI constrain + $(this).sortable("disable"); + _sortableRefresh(); + } + } + else if ( $(this).children().length == 2 ) { // for a single panel row - disable the insertion points above and below + $(this).next().sortable("disable");//.css("background-color", "red"); + $(this).prev().sortable("disable");//.css("background-color", "green"); + _sortableRefresh(); + } + +// DebugUtils.trace( "_sortableActivate", start) ; + + } + /** + * handle sortable over target + */ + function _sortableOver(event, ui) { + // var start = DebugUtils.getCurrfentTime(); + + that.equalizeWidths(event, ui); + + var numItems = $(this).children().length; + if ( $(ui.sender).context === $(this).context ) + numItems--; + + var width = Math.floor(96 / numItems) + "%"; + $('.vmPanelDropPlaceholder').css("width",width); + + // attempt to set width of helper to width of placeholder + //$(ui.helper).width($(ui.placeholder).width()); + +// var height = Math.max($(this).height(), $(ui.item).height()) + "px"; +// // DebugUtils.trace( "_sortableOver", start) ; + } + + function _sortableStop(event, ui) { + var start = DebugUtils.getCurrfentTime(); + + // on some rare cases you can drop the panel top a position where the mouse is not over it. + // for these cases we would like to apply the mouseout styling ann all panels, just to play safe. + that.dragAndDropMouseOut(); + + + // hide any visible menus + that.menusGC(); + + DebugUtils.trace("_sortableStop invoked") ; + + $(that.panelRowsSelector).sortable('destroy'); + + _removeEmptyRows(); + + that.equalizeWidths(event, ui, true); + + // save the state to the system + _save(); + + that.changeChartFlow(); + + $(".vmPanelDropPlaceholderOverlay", $(that.panelRowsSelector)).remove(); + + _generateEmptyRows(true); + + that.panelRowsAddOverlayLayers(true); + + // fire off the panel drop event, passing the dropped element as extra data + $(document).trigger(that.PANEL_DROP_EVENT, {droppedElement: ui.item[0]}); + + DebugUtils.trace( "_sortableStop end", start) ; + } + + + function _sortableInit( setParams ) { + var start = DebugUtils.getCurrfentTime(); + var sortable; + + if (setParams ) + sortable = $(that.panelRowsSelector).sortable(sortableParameters); + else + sortable = $(that.panelRowsSelector).sortable(); + + + sortable.disableSelection(); + + _bindEvents(); + + DebugUtils.trace( "_sortableInit ("+(setParams)+") ", start) ; + return sortable; + } + + function _sortableRefresh(setParams) { + var start = DebugUtils.getCurrfentTime(); + var sortable = _sortableInit(setParams).sortable("refresh"); + DebugUtils.trace( "_sortableRefresh", start) ; + return sortable; + } + + + function _generateEmptyRows(doRefresh) { + + var counter = 1; + $(that.panelRowsSelector).each(function(){ + _addEmptyRow($(this), "before"); + }); + _addEmptyRow($(that.panelRowsSelector).last(), "after", 100); + + // XXX not sure what is causing this, but sometimes new rows are getting a 0 opacity. + // This ugly woraround takes care of that. + $(".layoutRow").fadeTo(0, 1); + + doRefresh ? _sortableRefresh(true) : _sortableInit(true); + + + function _addEmptyRow(element, where, rowHeight) { + var start = DebugUtils.getCurrfentTime(); + + rowHeight = rowHeight ? rowHeight : newRowHeight; + var newElement = $(document.createElement("div")).addClass("layoutRow equalHeightRow splClearfix panel_row1_col").css("min-height", rowHeight + "px"); + ( where == "after" ) ? element.after(newElement) : element.before(newElement); + + DebugUtils.trace( "_addEmptyRow", start) ; + } + } + + + function _removeEmptyRows() { + var start = DebugUtils.getCurrfentTime(); + + $(that.panelRowsSelector).each(function(){ + if ( $(this).children().length == 0 ) + $(this).remove(); + }); + +// $(".vmPanelDropPlaceholderOverlay", $(that.panelRowsSelector)).css("opacity", "0.2").css("background-color", "white"); +// $(".layoutCellInner", $(that.panelRowsSelector)).parent().children().first().css("box-shadow", "0 0 5px #CCCCCC"); + + DebugUtils.trace( "_removeEmptyRows", start) ; + } + + + + + function _save() { +// var start = DebugUtils.getCurrfentTime(); + $.post(Splunk.util.make_url(['viewmaster', Splunk.util.getCurrentApp(), Splunk.ViewConfig.view.id].join('/')), { + 'action': 'edit', + 'view_json': JSON.stringify(_toJSON()) + }, + _onSaveCallback, 'json'); + +// DebugUtils.trace( "_save", start) + function _toJSON() { + var output = {}; + output['new_panel_sequence'] = []; + + $(that.panelRowsSelector).each(function() { + var rowSet = []; + $('.paneledit', this).each(function() { + var s = parseInt($(this).attr('data-sequence'), 10); + if (!isNaN(s)) + rowSet.push(s); + }); + output['new_panel_sequence'].push(rowSet); + }); + return output; + } + + function _onSaveCallback(jsonObject){ + if (jsonObject.success) { + // reset the current indexing to future actions + that.resetSequence(); + } + else { + for (var i=0,L=jsonObject.messages.length; i"); + lastRefreshedSpan.addClass("splLastRefreshed"); + lastRefreshedSpan.attr("title", sprintf(this.FULL_REFRESHED_TIME, {dateText: longDateText})); + if (shortDateText === this.NOW_REFRESHED_TIME) { + lastRefreshedSpan.html(sprintf(this.NOW_REFRESHED_TIME)); + } else { + lastRefreshedSpan.html(sprintf(this.GENERIC_REFRESHED_TIME, {dateText: shortDateText})); + } + + // 4 go find the correct panel title + $('h2[title="' + group + '"]').closest('.layoutCell').find('.meta').attr('title', group); + $('.meta[title="' + group + '"]').find("span.splLastRefreshed").remove(); + $('.meta[title="' + group + '"]').prepend(lastRefreshedSpan); + }, + /** + * Auto truncates the panel headers based on available width + */ + handlePanelResize: function() { + this.titleHeaders.each(function() { + // without this check it has the neat effect of nuking the contents of all $(".splHeader h2") + // including those in modules like ResultsHeader. + if ($(this).attr('title')) { + // this is just a trial and error calculation; could be smarter + var charWidth = parseInt(Math.pow($(this).parent().width() / 12 - 15, 1.15), 10); + //$(this).text(Splunk.util.smartTrim($(this).attr('title'), charWidth)); + } + }); + // set equal heights in view mode only + if(!this.editMode) { + this.equalizeHeights(); + } + }, + + /** + * This method catches the case where the user is looking at a new simple + * dashboard that has no panels, and displays an accelerator link + */ + showDashboardPrompts: function() { + var view_config = Splunk.util.getCurrentViewConfig(); + if (view_config.hasOwnProperty('view') && view_config['view']['objectMode'] != 'SimpleDashboard') { + return false; + } + var panelCount = $('.dashboardCell').length; + if (panelCount == 0) { + var link = $( _('

This dashboard is empty. Edit the dashboard to add a panel.

')).bind('click', function() { + Splunk.Globals.Viewmaster.openDashEditForm(Splunk.util.getCurrentView()); + return false; + }).appendTo($('.layoutRow.firstRow')); + } + }, + /** + * This method equalizes heights of dashboard cells within the same panel + */ + equalizeHeights: function() { + var start = DebugUtils.getCurrfentTime(); + $(".equalHeightRow").each(function(){ + $(this).find('.layoutCellInner').css({'min-height': 0}); + if ($.browser.msie && $.browser.version == 6.0) { + $(this).children().css({'height': 0}); + } + var max = 0; + $(this).find('.layoutCellInner').each(function(i){ + if ($(this).height() > max) { max = $(this).height(); } + }); + if ($.browser.msie && $.browser.version == 6.0) { $(this).find('.layoutCellInner').css({'height': max}); } + $(this).find('.layoutCellInner').css({'min-height': max}); + }); + DebugUtils.trace( "equalizeHeights", start) ; + }, + + /** + * This method traverses the dashboard rows from top to bottom, whenever it finds one that will have a page break + * in the middle of it, inserts a page-breaking element above it + */ + insertPageBreakers: function() { + // IE9 and IE10 can handle page breaking purely in CSS + if($.browser.msie && parseFloat($.browser.version) >= 9) { + return; + } + var $row, rowHeight, + currentHeight = 0, + $pageBreaker = $('
'), + pageBreakHeight = ($.browser.msie) ? 800 : 900; // pixel height to use when breaking up the page + + $('.equalHeightRow').each(function(i, row) { + $row = $(row); + // caclulate the row height, force to zero for empty elements, since some browsers will report a non-zero height + rowHeight = ($row.is(':empty')) ? 0 : $row.outerHeight(true); // true means include margin + if(i != 0 && rowHeight > 0 && currentHeight + rowHeight >= pageBreakHeight) { + // this element needs a page break before it + $pageBreaker.clone().insertBefore($row); + currentHeight = rowHeight; + } + else { + currentHeight += rowHeight; + } + }); + }, + + removePageBreakers: function() { + if($.browser.msie && parseFloat($.browser.version) >= 9) { + return; + } + $('.page-breaker').remove(); + } + +}); + +var DebugUtils = { + + traceEnabled: false, + + getCurrfentTime: function() { + if(this.traceEnabled) + return (new Date()).getTime(); + }, + trace: function(arg, start) { + if( this.traceEnabled && window.console) { + var now = this.getCurrfentTime(); + arg = this._addSpaces(arg, 30); + if (start) + arg += ["\t", (now - start)].join(''); + console.log([now, "\t", arg].join('')); + } + }, + _addSpaces: function(str, len) { + var newStr = str; + while(newStr.length < len) + newStr += " "; + + return newStr; + } +}; + + + + + diff --git a/apps/eventid/appserver/static/default.css b/apps/eventid/appserver/static/default.css new file mode 100644 index 00000000..37a0cd51 --- /dev/null +++ b/apps/eventid/appserver/static/default.css @@ -0,0 +1,2152 @@ +/* + * Glorious Splunk Skin + * + */ + + + + +/* Basic Typography +---------------------------------*/ +body, td { + font-family:Arial,Helvetica,sans-serif; + font-size:11px; + color: #333; +} + +input, textarea, select, optgroup { + font-family:Arial,Helvetica,sans-serif; + font-size:12px; + color: #111; +} + +h1 { + font-size: 18px; + font-weight: normal; + color:#73A550; +} +h2 { + font-size: 12px; + font-weight:bold; + color: #333; +} +h3 { + font-size: 12px; + font-weight: bold; + color: #333; +} +h4 { + font-size: 11px; + font-weight: bold; + color: #333; +} + +/* font styles */ +.splFont-mono, .SearchBar label { + font-family: Consolas,Monaco,Courier New,monospace; +} + +.SearchBar textarea, .SearchBar label { + font-size: 12px; + -moz-box-shadow: none; + -webkit-box-shadow: none; + box-shadow: none; +} +.SearchBar textarea:focus { + outline: 0; +} + +/* link colors +---------------------------------*/ +a { + color: #1a7996; +} +a.disabled { + color:#999; +} + +/* panel-specific font colors +---------------------------------*/ +.appHeaderWrapper { + color: #666; +} +.appHeaderWrapper a { + color: #CCC; +} + +.appHeaderWrapper a.help { + background: url(../../../img/skins/default/icon-help-12.png) no-repeat left center; + _background: url(../../../img/skins/default/icon-help-12-black-ie6.png) no-repeat left center; /* for ie 6 */ + display: block; + padding-left: 16px; + float: left; +} + + +/* Application Header +_________________________________*/ +/* app header wrapper */ +/* - this can be used to set a background for the entire header area. */ +.appHeaderWrapper { + background: #000 url(/static/img/skins/default/bg_appHeaderWrapper.png) repeat-x; +} +/* application header */ +.appHeader { + /* height:100px; // to change the height of the header area, add a height property here. */ +} + +/* change the app logo here. set the height/width for your image, as well as the path to the image */ +.appLogo { + height: 43px; + width: 80px; + background: url(/static/img/skins/default/splunk_logo_black.png) no-repeat 0 0; + _background: url(/static/img/skins/default/splunk_logo_black.gif) no-repeat 0 0; +} + +/* +use this to display the name of the app. +use line-height to adjust alignment with logo. if +if the name of the app is in the logo, set this to display: none; +*/ +.appHeaderWrapper h1 { + color:#73a550; + line-height: 43px; +} + + +/* background colors +---------------------------------*/ + +/* default page color */ +body, .splBackground-default, .graphArea, .resultsArea, +.reportSecondPanel, .reportThirdPanel, .sidebarCollapsed, +.SearchBar .saTypeaheadWrapper { + background-color: #FFF; +} + +/* primary background - applies to search controls and primary action panels */ +.viewHeader, .mainSearchControls, .splSearchControls-inline, +.SearchBar .saHelpWrapper { + background-color: #edede7; +} + +/* secondary background - sidebar, other panels */ +.splBackground-secondary, .sidebarExpanded { + background-color:#edede7; +} + +/* Specific overrides */ +.layoutCellInner .ResultsHeader .splHeader, .layoutCellInner .ResultsHeader .splHeader-secondary { + background: transparent none; +} + + +/* headers +---------------------------------*/ +.splHeader-primary { + border-top-width: 1px; + border-top-style: solid; +} + +.splHeader-secondary { + border-top-width: 1px; + border-top-style: solid; +} + + + +.splHeader-secondary { + background-color: #edede7; + _background-position: 0px -111px; +} +/* navigation bar */ +.splHeader-navigation { + background-image: none; + _background-image: none; +} + +.splHeader h2 a { + font-weight:normal; +} + +/* Specific overrides */ +.TitleBar .splHeader, .FieldPickerPopup .splHeader-primary { + background-color: #edede7; + background-image: none; +} + +.FlashTimeline .splHeader-primary { + background: #fff url(/static/img/skins/default/overlay_topgradient_7.png) repeat-x; + _background-image: none; +} + +.FlashTimeline { + background: #fff url(/static/img/skins/default/overlay_bottomgradient_7.png) repeat-x bottom center; + _background-image:none; +} + +.DisableRequiredFieldsButton { + background: #edede7 url(/static/img/skins/default/overlay_topgradient_32.png) repeat-x; + _background-image:none; +} + +.splView-flashtimeline .ResultsHeader .splHeader-primary { + background: #edede7 url(/static/img/skins/default/overlay_topgradient_32.png) repeat-x; + _background-image:none; + border-color: #a4a4a4; + padding-top: 5px; +} + +.splView-flashtimeline .ResultsHeader .splHeader-primary h2 { + background-color: #fff; + -webkit-border-top-left-radius: 6px; + -moz-border-radius-topleft: 6px; + border-top-left-radius: 6px; +} + +/* borders +---------------------------------*/ +* { + border-color: #ccc; +} + +div.sidebarCollapsed .sidebarControl { + -moz-border-radius: 0 0 5px 0; + -webkit-border-radius: 0 0 5px 0; + border-radius: 0 0 5px 0; + background: #edede7 url(/static/img/skins/default/overlay_topgradient_32.png) repeat-x; + border-top: 1px solid #A4A4A4; +} + +div.sidebar .FieldPicker { + border-color: #a4a4a4; +} + +/* Dashboards +_______________________________*/ + +/* dashboard headers */ + +body.splTemplate-dashboard { + background-color: #EDEDE7; +} +.splHeader-dashboard { + background-image: none; +} +.splHeader-dashboard { + background-color: transparent; +} +.splHeader-dashboard h2, +.dashboardContent .ServerSideInclude h2, +.dashboardContent .GenericHeader h3 { + font-size:12px; + color: #73a550; + font-weight:bold; + background-color: transparent; +} +/* rounded box for dashboard modules */ +.dashboardCell { + position: relative; + background: #fff; + border-style: solid; + border-width: 1px; + -moz-border-radius: 5px; + -webkit-border-radius: 5px; + border-radius: 5px; + -moz-box-shadow: 0 0 5px rgba(0, 0, 0, 0.25); + -webkit-box-shadow: #ccc 0 0 5px; + box-shadow: #ccc 0 0 5px; + _background-image: none; +} + +.dashboardContent .SimpleResultsTableResults, .dashboardContent .EventsViewer { + background-image: none; + background: transparent; +} + + + +/* form elements +_________________________________*/ +fieldset legend { + color: #73A550; + font-size: 14px; + font-weight: bold; +} +fieldset legend span{ + color: #000; + font-size: 10px; + font-weight: normal; +} +input, textarea, select { + font-family: Arial, Helvetica, sans-serif; + font-size: 11px; +} +input[type="text"], input[type="textfield"], input[type="password"], +textarea, .input-facade, +.splTextAreaStd, +.codeMirrorTextAreaWrapper, +div.accumulator-scrollbox { + box-shadow: inset 0px 1px 3px #ccc; +} +.input-hide, input.input-hide, textarea.input-hide, +.splTextAreaStd textarea { + box-shadow: none; +} +label { + font-size: 12px; +} +label.disabledLabel { + color:#666; +} +select option[disabled] { + color:#999; + box-shadow: none; +} +input.readonly { + background-color: #999; + box-shadow: none; +} +p.exampleText { + color: #666; + clear: both; +} +p.fieldsetHelpText { + color: #666; +} +input[disabled]{ +background-color: #f4f4f1; +color: #333; +padding-left: 0; +box-shadow: none; +} +.splTextArea { + border:1px solid #ccc; +} + + +/* tables +------------------------------*/ +table.splTable { + border-color: #999; +} +table.splTable th { + border-color: #999; +} +table.splTable th a { + color: #000; +} +table.splTable td { + border-color: #CCC; +} +.empty_results { + background: #edede7; + border: 0px !important; + font-size: 12px; + font-weight: normal !important; + padding: 10px !important; + -webkit-border-radius: 4px; + -moz-border-radius: 4px; + border-radius: 4px; + color: #666 !important; +} + +/* sorting */ +.splSortNone, .splSortAsc, .splSortDesc { + background-image: url(/static/img/skins/default/splIcons.gif); + background-position: -67px -446px; + background-repeat: no-repeat; + cursor: pointer; +} +.splSortDesc { + background-position: -67px -365px; +} +.splSortDesc:hover { + background-position: -67px -385px; +} +.splSortAsc{ + background-position: -67px -385px; +} +.splSortAsc:hover { + background-position: -67px -366px; +} + +/* global elements +---------------------------------*/ +.splPipe { + color:#999; +} +.splDivider { + border-bottom-style: solid; + border-bottom-width: 1px; +} +#loading { + background-color:#73a550; + color:#fff; +} /* I smell a refactor here... */ +#loadingmessage { + font-size:18px; + background: url(/static/img/skins/default/loading_white.gif) no-repeat 0 0; +} +.popupLoading { + background: url(/static/img/skins/default/loading_white.gif) no-repeat 0 20px; + font-size:18px; +} +.mouseoverHighlight, .mouseoverHighlight td { + background-color:#f5e998; +} + +.searchFieldGhost { + border-color: #333; +} +.widgeterror { color: red; font-weight: bold; } + +.resultStatusMessage { + color: #666; +} + +/* percentage bar graph +_________________________________*/ +.splBarGraph { + background: #edede7; +} +.splBarGraphBar { + background: #73a550 url(/static/img/skins/default/overlay_gradient_28.png) repeat-x; +} +.splBarGraphValue { + +} + +.graphLoading { + padding-bottom: 5px; +} + +/* popups +---------------------------------*/ + +.popupContainer { + z-index:10000; + border-color: #666; + -moz-box-shadow: 0 0 8px rgba(0, 0, 0, 0.7); + -webkit-box-shadow: #222 0 0 8px; + box-shadow: #222 0 0 8px; +} + +.wizardPopup .popupContent iframe { + width:400px; + border:none; + display: block; +} + +.wideTreeviewPopup .popupContent iframe { + width:700px; + height:433px; + border:none; + display: block; +} + +.panelEditorPopup .popupContent iframe { + width:340px; + border:none; + display: block; +} +.panelEditorPopup .popupContent { + min-width:340px; +} + +.fieldValuePopup { + border-color: #666; + -moz-box-shadow: none; /* needs dropshadow for others than ff3.5 and safari 4, removing this one and adding the jank normal dropshadow from menu*/ + -webkit-box-shadow: none; + box-shadow: none; + border: none; +} +.fieldValuePopup .fieldValuePopupInner { + border:1px solid #CCC; + background-image:url(/static/img/skins/default/bg_reversegradient_28.png); +} + +/* fieldpicker popup */ +.fieldLayers .popupContainer { + border-color: #ccc; +} + +.pdfPopup { + background: #fff; +} + +/* popup header bar */ +.splHeader-popup { + background: #000 url(/static/img/skins/default/overlay_gradient_28.png) repeat-x 0 0; + _background: #000 url(/static/img/skins/default/backgrounds_ie6.gif) repeat-x 0 -450px; +} +.splHeader-popup h2 { + color:#FFF; + font-size:14px; +} + +.splHeader-popup, .splHeader-popup h2 { + cursor: move; +} + +/*iframe loading*/ +.popupContent .popup-loading { + width: 100%; + height:100%; + position:absolute; + top:0; + text-indent:-1000em; + direction:ltr; + background: #fff url('/static/img/skins/default/loading_white.gif') no-repeat center center; + _height:100px; /* IE6 won't recalculate height properly :( */ +} + +/* popup content */ +.popupContent { + background-color: #FFF; + position:relative; + _zoom:1; +} + +.popupContent .error, .wizard .error { + font-size: 12px; + background: #af4444; + margin: 10px; + margin-bottom: 0px; + + -moz-border-radius:4px 4px 4px 4px; + -webkit-border-radius: 4px 4px 4px 4px; + border-radius: 4px 4px 4px 4px; +} + +/* popup footer (button container) */ +.popupFooter { + background: #edede7 url(/static/img/skins/default/overlay_topInnerShadow_35.png) repeat-x; + _background: #000 url(/static/img/skins/default/backgrounds_ie6.gif) repeat-x 0 -231px; +} + +/* Field Value popup-specific styles */ + +.fieldValuePopup h3 em { + font-size:11px; +} + +.fieldValuePopup table th.fieldName { + font-weight: normal; +} + +.fieldValuePopup table tr:first-child th.fieldName { + font-weight: bold; +} + +.fieldValuePopup table td, .fieldValuePopup table th { + color:#333; + border-bottom-style: dotted; + border-bottom-width: 1px; +} + +.fieldValuePopup table tr.fieldNameHeaderRow th { + border-bottom-style: solid; + border-bottom-width: 1px; +} + +.fieldValuePopup table tr.fieldNameHeaderRow td { + font-weight:bold; + color:#000; + border-bottom: none; +} +.fieldValuePopup p.reportLinks, +.fieldValuePopup div.reportLinks +{ + -moz-border-radius: 4px; + -webkit-border-radius: 4px; + border-radius: 4px; +} + +/* overlays and shadows +---------------------------------*/ +.splOverlay, .splOverlay-white { + background-color: #000; + opacity:0.7; + filter:alpha(opacity=70); +} +.splOverlay-white { + background-color:#FFF; +} + +.splShadow { + background: url(/static/img/skins/default/shadow_soft.png) no-repeat bottom right; + -moz-border-radius-bottomleft: 16px; /*is this supposed to be different?*/ + -moz-border-radius-topright: 17px; + -webkit-border-top-right-radius: 17px; + -webkit-border-bottom-left-radius: 17px; + border-top-right-radius:17px; + border-bottom-left-radius:17px; + _background: none; +} + +/* buttons +---------------------------------*/ + +.splButton-primary, +.splButton-secondary, +.splButton-tertiary { + background: #73a550 url(/static/img/skins/default/overlay_gloss_28.png) repeat-x left -3px; + color: #FFF; + font-family: Arial, Helvetica, sans-serif; + font-size:12px; + border: 1px solid #5e8d3d; + -moz-border-radius: 4px; + -webkit-border-radius: 4px; + border-radius: 4px; + _background-image: none; +} +button.splButton-primary span, +button.splButton-secondary span, +button.splButton-tertiary span +{ + line-height:21px; /*Note: line-height won't work on buttons in FF*/ +} + +.splButton-primary { + color:#fff; + background-color: #659c40; + border: 1px solid #5e8d3d; +} +.splButton-secondary { + color: #333; + background-color:#fff; + border: 1px solid #bbb; +} +.splButton-tertiary { + color:#fff; + background-color: #548ea0; + border: 1px solid #498a99; +} + +.splButton-primary:hover, +.splButton-primary:focus { + background-color: #4e7830; + outline: none; +} + +.splButton-secondary:hover, +.splButton-secondary:focus { + background-color: #f3f3f3; + border-color: #aaa; + outline: none; +} + +.splButton-tertiary:hover, +.splButton-tertiary:focus { + background-color: #326c79; + outline: none; +} + +.splButton-disabled, +.splButton-disabled:hover, +.splButton-disabled:focus { + background: #bbb; + color: #999; + border-color: #999; +} + +.splButton-disabled .splButtonIcon { + opacity:0.5; +} + +.splButton-primary span.splMenuIcon, +.splButton-tertiary span.splMenuIcon { + background-position: 0 -300px; +} + +/* buttons Groups +---------------------------------*/ + +.splButtonGroup .splButton-primary, +.splButtonGroup .splButton-secondary, +.splButtonGroup .splButton-tertiary { + -moz-border-radius: 0; + -webkit-border-radius: 0; + border-radius: 0; + margin:0; + border-left-color: #8FB777; +} +.splButtonGroup .splButton-secondary { + border-left-color: #ddd; +} + +.splButtonGroup .splButton-tertiary { + border-left-color: #7ca6b0; +} + +.splButtonGroup .splButton-disabled { + border-left-color: #bbb; +} + +.splButtonGroup .splButton-primary:first-child, +.splButtonGroup .splButton-secondary:first-child, +.splButtonGroup .splButton-tertiary:first-child { + -moz-border-radius-bottomleft: 4px; + -webkit-border-bottom-left-radius: 4px; + border-bottom-left-radius: 4px; + -moz-border-radius-topleft: 4px; + -webkit-border-top-left-radius: 4px; + border-top-left-radius: 4px; + border-left-color: #5E8D3D; +} + +.splButtonGroup .splButton-secondary:first-child { + border-left-color: #ccc; +} + +.splButtonGroup .splButton-tertiary:first-child { + border-left-color: #498A99; +} + +.splButtonGroup .splButton-disabled:first-child { + border-left-color: #999; +} + +.splButtonGroup .splButton-primary:last-child, +.splButtonGroup .splButton-secondary:last-child, +.splButtonGroup .splButton-tertiary:last-child { + -moz-border-radius-bottomright: 4px; + -webkit-border-bottom-right-radius: 0; + border-bottom-right-radius: 4px; + -moz-border-radius-topright: 4px; + -webkit-border-top-right-radius: 0; + border-top-right-radius: 4px; + border-right-width:1px; +} + +/* Iconic Links +---------------------------------*/ + +.splIconicLinkIcon, .splButtonIcon, span.splMenuIcon { + background-image: url(/static/img/skins/default/sprite_button_icons.png); + _background-image: url(/static/img/skins/default/sprite_button_icons.gif); + background-position: 0 0; +} + + +.splIconicLinkIcon { + margin-top:2px; +} +.splIconicLinkLabel { + font-size:11px; +} + +.splIconicLinkDisabled { + background-image: none; + color: #999; +} + + +.splIconicLinkDisabled .splIconicLinkIcon { + -moz-opacity: 0.45; + opacity: 0.45; + -ms-filter:"progid:DXImageTransform.Microsoft.Alpha(Opacity=45)"; /* IE8 */ + filter: progid:DXImageTransform.Microsoft.Alpha(Opacity=45); /* IE7 */ + filter:alpha(opacity=50); /* IE6 */ + + color: #999; + -moz-border-radius: 3px; + -webkit-border-radius: 3px; + border-radius: 3px; +} + +.splIcon-export { + background-position: -26px -660px; +} + +.splIconicLinkDisabled .splIcon-export { + background-position: -13px -660px; +} + +.splIcon-options { + background-position: -26px -680px; +} + + +/* Splunk search button */ + +/* search button */ +input.searchButton { + background-color: #659c40; + background-image: url(/static/img/skins/default/search_button.png); + /* white > */ + background-position: right center; + /* black > -- uncomment for black arrow. -- + background-position: left center; + */ + /* corner rounding for good browsers */ + -moz-border-radius: 4px; + -webkit-border-radius: 4px; + border-radius: 4px; + + border: 1px solid #5e8d3d; + font-family: Arial, Helvetica, sans-serif; + cursor: pointer; + + + _background-image: url(/static/img/skins/default/green_search_button.png); + _background-color:transparent; + _border: none; + _zoom:1; +} + +input.searchButton:hover, +input.searchButton:focus { + background-color: #4e7830; + _background-color:transparent; +} + +table.mainSearchControlsTable input.searchButton { + border-left-color: #8fb777; + -moz-border-radius-topleft: 0; + -moz-border-radius-bottomleft: 0; + -webkit-border-top-left-radius: 0; + -webkit-border-bottom-left-radius: 0; + border-bottom-left-radius: 0; + border-top-left-radius: 0; + border-bottom-left-radius: 0; +} + +/* button wrapper */ +.splButtonWrapper { + border-top-width:1px; + border-top-style:solid; +} + +/* icons +---------------------------------*/ +.splIcon { + background-image: url(/static/img/skins/default/splIcons.gif); + background-color: #999; +} + +/*-- external link icon --*/ +.spl-icon-external-link-xsm { + background: transparent url(/static/img/skins/default/icon-external-xsm.png) no-repeat 0 0; + _background: transparent url(/static/img/skins/default/icon-external-xsm.gif) no-repeat 0 0; + background-repeat:no-repeat; + background-position: 0% 50%; + display:inline-block; + padding-left: 15px; + margin-left: 5px; + font-style: normal; +} +.spl-icon-external-link-xsm.inline-icon { + margin-left: 0px; +} + +/*-- sidebar collapse icon --*/ +.splIcon-sidebar-open .splIconicLinkIcon { background-position: -26px -320px; } +.splIcon-sidebar-closed .splIconicLinkIcon { background-position: -26px -340px; } + +/*-- linear and log scale buttons --*/ +div.FlashTimeline a.linLogToggle { + color:#000; +} + +div.FlashTimeline a.linLogToggle:focus { + background-color: #ccc; +} + +div.FlashTimeline a.linLogToggle .splIcon-triangle-4-s { + background-position: -67px -367px; +} + + + +/*-- clear buttons --*/ +.splIcon-clear { + -webkit-border-radius: 6px; + -moz-border-radius: 6px; + border-radius: 5px; + background-position: 0px 0px; +} +html>/**/body .splIcon-clear, x:-moz-any-link, x:default { /* do rounding for ff3, not ff2 */ + -moz-border-radius: 5px; +} +.splIcon-clear:hover { background-position: -20px 0px; } + +/*-- close icons --*/ +.splIcon-close { background-position: 0px 0px; } +.splIcon-close:hover { background-position: -20px 0px; } + +/*-- arrow icons --*/ +.splIcon-arrow-n, .splIcon-arrow-e, .splIcon-arrow-s, .splIcon-arrow-w { + -webkit-border-radius: 6px; + -moz-border-radius: 6px; + border-radius: 5px; + background-color: #999; +} +html>/**/body .splIcon-arrow-n, html>/**/body .splIcon-arrow-s, html>/**/body .splIcon-arrow-e, +html>/**/body .splIcon-arrow-w, x:-moz-any-link, x:default { /* do rounding for ff3, not ff2 */ + -moz-border-radius: 5px; +} +.splIcon-arrow-n { background-position: 0px -100px; } +.splIcon-arrow-e { background-position: 0px -140px; } +.splIcon-arrow-s { background-position: 0px -120px; } +.splIcon-arrow-w { background-position: 0px -160px; } +.splIcon-arrow-n:hover { background-position: -20px -100px; } +.splIcon-arrow-e:hover { background-position: -20px -140px; } +.splIcon-arrow-s:hover { background-position: -20px -120px; } +.splIcon-arrow-w:hover { background-position: -20px -160px; } + +/*-- results view buttons --*/ +.splIcon-events-list, .splIcon-events-table, .splIcon-results-table, .splIcon-results-chart { + background-image: url(/static/img/skins/default/sprite_button_icons.png); + _background-image: url(/static/img/skins/default/sprite_button_icons.gif); +} +.splIcon-events-list { background-position: -26px -740px; } +.splIcon-events-table { background-position: -26px -760px; } +.splIcon-results-table { background-position: -26px -780px; } +.splIcon-results-chart { background-position: -26px -800px; } +.splIcon-events-list:hover { background-position: -39px -740px; } +.splIcon-events-table:hover { background-position: -39px -760px; } +.splIcon-results-table:hover { background-position: -39px -780px; } +.splIcon-results-chart:hover { background-position: -39px -800px; } + +/* triangles */ +/* Note: to separate color from implementation, we're using a numbering system to differentiate colors. + 1=grey,2=white,3=green,4=black,5=blue. If the icon sprite changes, the number mapping to colors would be different */ +.splIcon-triangle, +.splIcon-triangle-1-n, .splIcon-triangle-1-s, .splIcon-triangle-1-e, .splIcon-triangle-1-w, +.splIcon-triangle-2-n, .splIcon-triangle-2-s, .splIcon-triangle-2-e, .splIcon-triangle-2-w, +.splIcon-triangle-3-n, .splIcon-triangle-3-s, .splIcon-triangle-3-e, .splIcon-triangle-3-w, +.splIcon-triangle-4-n, .splIcon-triangle-4-s, .splIcon-triangle-4-e, .splIcon-triangle-4-w, +.splIcon-triangle-5-n, .splIcon-triangle-5-s, .splIcon-triangle-5-e, .splIcon-triangle-5-w { + background-color:transparent; +} +.splIcon-triangle-large { + background-color:transparent; +} + +/* grey */ +.splIcon-triangle-1-n { background-position: -7px -386px; } +.splIcon-triangle-1-s { background-position: -7px -367px; } +.splIcon-triangle-1-e { background-position: -7px -407px; } +.splIcon-triangle-1-w { background-position: -7px -427px; } +/* white */ +.splIcon-triangle-2-n { background-position: -27px -386px; } +.splIcon-triangle-2-s { background-position: -27px -367px; } +.splIcon-triangle-2-e { background-position: -27px -407px; } +.splIcon-triangle-2-w { background-position: -27px -427px; } +/* green */ +.splIcon-triangle-3-n { background-position: -47px -386px; } +.splIcon-triangle-3-s { background-position: -47px -367px; } +.splIcon-triangle-3-e { background-position: -47px -407px; } +.splIcon-triangle-3-w { background-position: -47px -427px; } +/* black */ +.splIcon-triangle-4-n { background-position: -67px -386px; } +.splIcon-triangle-4-s { background-position: -67px -367px; } +.splIcon-triangle-4-e { background-position: -67px -407px; } +.splIcon-triangle-4-w { background-position: -67px -427px; } +/* blue */ +.splIcon-triangle-5-n { background-position: -87px -386px; } +.splIcon-triangle-5-s { background-position: -87px -367px; } +.splIcon-triangle-5-e { background-position: -87px -407px; } +.splIcon-triangle-5-w { background-position: -87px -427px; } + +/* state interaction +_________________________________*/ + +.fatal, .error, .warn, .info, .persistent { + background: url(/static/img/skins/default/overlay_gradient_28_plus.png) repeat-x top left; + _background: #000 none; + font-weight: bold; +} + +.fatal, .error { + background-color: #a62f2f; + color: #fff; +} +.warn, .persistent { + background-color: #ffee91; + color: #000; +} +.info { + background-color: #e8f8ff; + color: #000; +} + + +.fatal .remove, .error .remove, .warn .remove, .info .remove, .persistent .remove { + background: #000 url(/static/img/skins/default/splIcons.gif) no-repeat top left; + -moz-border-radius: 4px; + -webkit-border-radius: 4px; + border-radius: 4px; +} + +.fatal .remove, .error .remove { + background-color: #6f2121; +} +.warn .remove, .persistent .remove { + background-color: #b9ac66; +} +.info .remove { + background-color: #94a9b2; +} + + +/* menu classes +---------------------------------*/ + +.splMenu { + font-size: 11px; + font-family: Arial, Helvetica, sans-serif; +} + +/* primary menu - white */ +.splMenu-primary, .splMenu-primary a { + color: #333; +} +.splMenu-primary li.disabled a { + color:#999; +} +.splMenu-primary ul { + background-color: #FFF; +} +.splMenu-primary .actionsMenuDivider { +} + +/* primary menu hover styles */ +.splMenu-primary li:hover { + background: #f3ecbb; +} +.splMenu-primary ul li.htmlBlock:hover { + background-color: transparent; +} + +/* secondary menu - black */ +.splMenu-secondary, .splMenu-secondary a { + color: #CCC; +} +.splMenu-secondary li.disabled a { + color:#999; +} +.splMenu-secondary ul { + background-color: #000; + border-color: #333; +} + +/* primary menu hover styles */ +.splMenu-secondary li:hover { + background-color: #7b9059; +} +.splMenu-secondary a:hover { + color: #FFF; +} +.splMenu-secondary ul li.htmlBlock:hover { + background-color: transparent; +} + +/* Tab styles +-------------------------------*/ + +.tabsWrapper { + background-color: #bdbdb7; +} +ul.tabs li { + background: #666 url(/static/img/skins/default/tab_switcher_rounded_corners.gif) no-repeat 0 -68px; +} +ul.tabs li a { + background: #666 url(/static/img/skins/default/tab_switcher_rounded_corners.gif) no-repeat right -102px; + color: #FFF; + font-size: 12px; +} +/* on state */ +ul.tabs li.selected { + background-color: #FFF; + background: #FFF url(/static/img/skins/default/tab_switcher_rounded_corners.gif) no-repeat 0 0; +} +ul.tabs li.selected a { + color: #333; + background: #FFF url(/static/img/skins/default/tab_switcher_rounded_corners.gif) no-repeat right -34px; +} + +/* jquery ui styles +_______________________________*/ + +/* datepicker styles */ +.ui-datepicker { + border: 1px solid #ccc; + background: #FFF; +} +.ui-datepicker a { + color: #333; +} +.ui-datepicker-inline { + border-style: solid; + border-width: 1px; +} +.ui-datepicker-header { + background: #edede7 url(/static/img/skins/default/overlay_gradient_28.png) repeat-x scroll 0 -5px; + _background: #edede7 url(/static/img/skins/default/backgrounds_ie6.gif) repeat-x scroll 0 -5px; +} +.ui-datepicker-header a { + background-image: url(/static/img/skins/default/splIcons.gif); + background-repeat: no-repeat; +} +.ui-datepicker-prev { + background-position: -67px -418px; +} +.ui-datepicker-next { + background-position: -67px -398px; +} +.ui-datepicker-current-day { + background-color: #a8c479; +} + +/* resizable styles */ +.ui-resizable-s { + background:#cdcdc7 url(/static/img/skins/default/bg_resizer.gif) center no-repeat !important; + _font-size:0; +} + +.ui-resizable-helper { + border: 1px dashed #999; +} + +/* TimeSpinner styles */ +.TimeSpinner { + border: 1px solid #ccc; +} + +/*********************************** + Module styles +************************************/ + +/* Dev note: putting these in here for now, figuring out what refactoring can be done later */ + + +/*** Gandalf ***/ + +/* TimeRangeBinning */ +.TimeRangeBinning .trbToggle { + font-size:12px; +} +.TimeRangeBinning .trbToggle span.splIcon-triangle { + background-position: -87px -407px; + background-color: transparent; +} +.TimeRangeBinning .trbOn span.splIcon-triangle { + background-position: -87px -367px; +} + +/*** Jobs ***/ + +/* Job Status */ + +.JobStatus { + background-color: #EDEDE7; +} + +.JobStatus .output .scanned, +.JobStatus .output .results { + font-style:normal; + font-size:12px; +} +.JobStatus .output .running h2, +.JobStatus .output .runningReport h2, +.JobStatus .output .finalizing h2 { + background: url(/static/img/skins/default/loader_green_on_grey.gif) left no-repeat; + /* use loader.gif for green on white */ +} + +.JobStatus .output .complete h2 { + background: url(/static/img/skins/default/bg_job_status.png) 0 -13px no-repeat; +} + +.JobStatus .output .paused h2 { + background: url(/static/img/skins/default/bg_job_status.png) 0 8px no-repeat; +} + +.autoPauseText > strong { + color: #900; +} + +/* link icons */ + + + +.save .splButtonIcon { + background-position: 0 -160px; +} + +.create .splButtonIcon { + background-position: 0 -180px; +} +.inspector .splButtonIcon { + background-position: 0 -120px; +} + +.print .splButtonIcon { + background-position: 0 -140px; +} + +.background .splButtonIcon{ + background-position: 0 -20px; +} + +.finalize .splButtonIcon { + background-position: 0 -80px; +} + +.pause .splButtonIcon { + background-position: 0 -60px; +} + +.unpause .splButtonIcon{ + background-position: 0 -40px; +} + +.cancel .splButtonIcon{ + background-position: 0 -100px; +} + +.schedulepdf .splButtonIcon{background-position:0 -560px;} +.move .splButtonIcon{background-position:0 -580px;} +.add .splButtonIcon{background-position:0 -640px;} +.permissions .splButtonIcon{background-position:0 -600px;} +.xml .splButtonIcon{background-position:0 -620px;} + +/* IE6 removal of gradient overlays */ +.JobStatus .splHeader { + _background-image: none; +} + +.JobStatus .autoPauseTip { + color: #800; +} +.JobStatus .autoPauseTip a { + color: #1a7996; +} + +/*** Nav ***/ + +/* AppBar */ +ul.appBarNav li a:hover, +ul.appBarNav li a.menuOpen { + background: url(/static/img/skins/default/overlay_white_28.png) repeat-x 0 0; + _background: url(/static/img/skins/default/backgrounds_ie.gif) repeat-x 0 -727px; +} +ul.appBarNav li a { + font-size: 11px; + font-weight: bold; +} +.splMenu-primary ul li.splUserCreated { + background-image: url(/static/img/skins/default/greendot.gif); + background-repeat: no-repeat; + background-position: 4px 10px; +} + +/* BreadCrumb */ +.BreadCrumb { + font-size:14px; +} +.BreadCrumb .gt { + color:#888; +} + +/* TitleBar */ +.TitleBar div.menuOpen, .TitleBar a.menuOpen { + background-color: #CCC; +} +.TitleBar h2 em { + font-style:normal; +} +.TitleBar .splPipe { + font-size:12px; +} + +/*** Results header ***/ +h2 .timeRangeStr { + font-weight: normal; +} + + +/*** Message ***/ +.Message ol { + font-size: 0px; + line-height: 1; +} +.Message ol li { + font-size: 11px; + line-height: 16px; + padding: 6px 10px; +} + +/*** Paginator ***/ + +.Paginator a, .Paginator .disabled:hover { + border-style: solid; + border-width: 1px; + border-color: #fff; + -moz-border-radius: 3px; + -webkit-border-radius: 3px; + border-radius: 3px; + _border-width:0px; +} +.Paginator a:hover { + border-color: #ccc; + text-decoration:none; +} +.Paginator .active a, .Paginator .active a:hover { + background-color: #999; + -webkit-box-shadow: inset 1px 1px 1px 0px #333333; + -moz-box-shadow: inset 1px 1px 1px 0px #333333; + box-shadow: inset 1px 1px 1px 0px #333333; + color: #fff; + border-color: #fff; +} +.Paginator .previous, .Paginator .next { + color:#999; +} + + +/*** Prototypes ***/ + +/* SimpleEventsViewer */ + +.SimpleEventsViewer { + background-color:#fff; +} +.SimpleEventsViewer span.searchTermHighlight { + background-color:#f5e998; +} +.SimpleEventsViewer .eventFields { + color: LightSlateGrey; +} +.SimpleEventsViewer .eventFields .value { + color: #000; +} + +/*** Results ***/ + +/* EventsViewer */ + +.EventsViewer, .SimpleResultsTableResults { +} + +.EventsViewerScroller { + border-top-style: solid; + border-top-width: 1px; +} +.EventsViewer .header { + font-weight:normal; + font-size:11px; + color:#333; +} +.EventsViewer .header em { + font-weight:bold; + font-style:normal; +} + +.EventsViewer .tb { + border:1px solid red; +} +.EventsViewer .tb h2 { + font-size:11px; + font-weight:bold; +} +.EventsViewer .tb h3 { + font-size:10px; + font-weight:bold; +} +.EventsViewer .tb td:first-child { + color:#666; +} +.EventsViewer .default .pos { + font-style:normal; + font-size:11px; + color:#bbb; +} +.EventsViewer .default .time { + font-style:normal; + font-size:11px; + color:#666; +} +.EventsViewer .default .audit { + font-style:normal; + display:block; + padding:2px 0px 4px 20px; + color:#666; +} +/* BEGIN NOTICE: decoration_audit_ class names currently have no indirection, do not change! */ +.EventsViewer .default .decoration_audit_valid { + background:url(/static/img/skins/default/audit_valid.gif) no-repeat; +} +.EventsViewer .default .decoration_audit_gap { + background:url(/static/img/skins/default/audit_gap.gif) no-repeat; +} +.EventsViewer .default .decoration_audit_tampered { + background:url(/static/img/skins/default/audit_tampered.gif) no-repeat; +} +.EventsViewer .default .decoration_audit_cantvalidate { + background:url(/static/img/skins/default/audit_cantvalidate.gif) no-repeat; +} +/* END NOTICE: decoration_audit_ class names currently have no indirection, do not change! */ +.EventsViewer .default .event { + font-family:Consolas, Monaco, Courier New, monospace; + font-size: 12px; + color:#333; +} +.EventsViewer .default .a, .EventsViewer .default .h, .EventsViewer .default .fields .v:hover, .EventsViewer .default .fields .tg:hover, .EventsViewer .default .time:hover { + background-color:#f5e998; +} +.EventsViewer .default .showinline { + color:#4D9BB3; +} +.EventsViewer .default .fields li { + color:#778899; +} +.EventsViewer .default .fields em { + font-style:normal; +} +.EventsViewer .default .fields .k { + color:#999; +} +.EventsViewer .default .fields .v { + color:#333; +} +.EventsViewer .default .fields .tg { + color:#999; + font-style:italic; +} +.EventsViewer .default .fields .fm { + background: url(/static/img/skins/default/splIcons.gif) no-repeat -67px -364px; + color:#FFF; +} +.actions .splButtonIcon { + background-position: 0 -280px; +} + + +.results-table-help { + font-size: 12px; +} + +/* BEGIN: tag field popup styles */ +.tagfieldpopup { + background:#FFF; +} +.tagfieldpopup input { + font-size:11px; + color:#333; +} + + + +/* FancyChartTypeFormatter */ +.FancyChartTypeFormatter .chartTypeTitle { + font-size: 12px; +} +.FancyChartTypeFormatter .chartTypeActivator { + border-style: solid; + border-width: 1px; + background: url(/static/img/skins/default/overlay_gradient_28.png) repeat-x 0 0; +} +.FancyChartTypeFormatter .chartTypeActivator span { + background: url(/static/img/skins/default/arrows.gif) no-repeat 0 0 ; +} +.FancyChartTypeFormatter .chartTypeMenu ul { + background-color:#FFF; + border-style: solid; + border-width: 1px; +} +.FancyChartTypeFormatter .chartTypeMenu li:hover { + background-color: #f3ecbb; +} +.FancyChartTypeFormatter .chartTypeActivator a, +.FancyChartTypeFormatter .chartTypeMenu li a { + color:#333; + text-decoration:none; + font-size:12px; + background-image:url(/static/img/skins/default/chart_type_icons.gif); + background-repeat:no-repeat; + background-position: 5px -45px; +} +.FancyChartTypeFormatter .chartTypeMenu li.column a, +.FancyChartTypeFormatter .chartTypeActivator a.column { + background-position: 5px 3px; +} +.FancyChartTypeFormatter .chartTypeMenu li.line a, +.FancyChartTypeFormatter .chartTypeActivator a.line { + background-position: 5px -45px; +} +.FancyChartTypeFormatter .chartTypeMenu li.area a, +.FancyChartTypeFormatter .chartTypeActivator a.area { + background-position: 5px -94px; +} +.FancyChartTypeFormatter .chartTypeMenu li.bar a, +.FancyChartTypeFormatter .chartTypeActivator a.bar { + background-position: 5px -144px; +} + +/* Timeline */ +/* + background-color -> controls bgcolor + border-left-color -> controls foregroundColor + color -> controls fontColor + border-right-color -> controls seriesColor +*/ + + +/********************************** +Timeline and charts +***********************************/ + +div.FlashTimeline, +div.FlashTimeline .splHeader { + background-color: #fff; + + /* Color of the chart lines */ + border-left-color: #000; + + /* Color of the columns */ + border-right-color: #73a550; + + color: #000; +} + +div.FlashTimeline a.splIconicLinkDisabled { + color: #999; +} + +div.FlashTimeline .splHeader { +/* background-image: none;*/ + border-top-width: 0; +} + + +div.FlashTimeline a.hideshow .splIconicLinkIcon { + background-position: -26px -400px; +} + +div.FlashTimeline .minimized a.hideshow .splIconicLinkIcon { + background-position: -26px -420px; +} + + +.TimelineContainer, +.FlashWrapperContainer { + padding-bottom: 7px; + _padding-bottom:0; +} + +.FlashTimeline .zoomIn .splIconicLinkIcon { + background-position: -26px -480px; +} + +.FlashTimeline .zoomOut .splIconicLinkIcon { + background-position: -26px -500px; +} + +.FlashTimeline .selectAll .splIconicLinkIcon { + background-position: -26px -520px; +} +.FlashTimeline .splIconicLinkDisabled.zoomIn .splIconicLinkIcon { + background-position: -13px -480px; +} + +.FlashTimeline .splIconicLinkDisabled.zoomOut .splIconicLinkIcon { + background-position: -13px -500px; +} + +.FlashTimeline .splIconicLinkDisabled.selectAll .splIconicLinkIcon { + background-position: -13px -520px; +} + + + +/* FlashChart */ +/* + background-color -> controls bgcolor + border-left-color -> controls foregroundColor + color -> controls fontColor +*/ +div.FlashChart { + background-color: #fff; + border-left-color: #000; + color: #000; +} + +/* JSChart: + * + * JSChart will adopt the same styles as FlashChart, this allows backwards compatibility with any styling + * applied to FlashChart in an application.css file + */ + +/* MultiFieldViewer + SuggestedFieldViewer */ +.MultiFieldViewer .fieldTabs .mouseoverHighlight, +.MultiFieldViewer .fieldTabs .selected, +.SuggestedFieldViewer .fieldTabs .mouseoverHighlight, +.SuggestedFieldViewer .fieldTabs .selected { + background-color:#C2D4DA; +} + +.MultiFieldViewer .fieldTabs .mouseoverHighlight a, +.SuggestedFieldViewer .fieldTabs .mouseoverHighlight a { + background-image: url(/static/img/skins/default/graph_icon.png); + background-repeat: no-repeat; + background-position: right 3px; +} + +.MultiFieldViewer .valueCount, +.SuggestedFieldViewer .valueCount { + color: #999; +} + +.MultiFieldViewer .iconNumeric, +.SuggestedFieldViewer .iconNumeric, +.MultiFieldViewer .iconString, +.SuggestedFieldViewer .iconString { + font-family: "Times New Roman", Georgia, Times, serif; + color: #999; + font-style: italic; + font-weight: bold; + font-size: 13px; + line-height: 12px; +} + +/* Count */ +.Count label, .Count select { + font-size: 11px; +} + +.pageControls .Count .perPageLabel{ + color: #333; +} + +/* EnablePreview */ +.pageControls .EnablePreview label { + font-size:11px; +} + +/* ResultsActionsButtons */ +.ResultsActionButtons { + background-color: #EDEDE7; +} + +/* SimpleResultsTable */ +table.simpleResultsTable td.pos, +table.simpleResultsTable th.pos { + color: #bbb; + border: none; +} +table.simpleResultsTable td.lowValue { + border: 1px solid blue; +} +table.simpleResultsTable td.highValue { + border: 1px solid red; +} + +/* SingleValue */ +.SingleValueHolder { + background-color: #ccc; + -moz-border-radius: 4px; + -webkit-border-radius: 4px; + border-radius: 4px; + font-size: 16px; + font-weight: bold; + -moz-box-shadow: inset 0 0 5px rgba(0, 0, 0, 0.25); + -webkit-box-shadow: inset 0 0 5px rgba(0, 0, 0, 0.25); + box-shadow: inset 0 0 5px rgba(0, 0, 0, 0.25); + background-image:url(/static/img/skins/default/overlay_gradient_50.png); + background-repeat: repeat-x; + _background-image: none; + +} +.SingleValue .severe { + background-color: #bb2121; + color: #fff; +} +.SingleValue .high { + background-color: #e67918; + color: #fff; +} +.SingleValue .elevated { + background-color: #e9da34; + color: #000; +} +.SingleValue .guarded { + background-color: #4da6df; + color: #fff; +} +.SingleValue .low { + background-color: #72c72d; + color: #fff; +} +.SingleValue .None { + background-color: #999; + color: #fff; +} + +/*** Search ***/ + +/* Field Picker */ + +.FieldPickerPopup .fpUpdateFields, .FieldPickerPopup .fpUpdateFieldsUpdate { + color: #E5F2F5; +} +.FieldPickerPopup li.fpSelFieldsNotPresent { + color:#999; +} +.FieldPickerPopup .fpAddTermCell span.splIcon-arrow-e { + background-color: #73a550; +} +.FieldPickerPopup li.fpSelFieldsNotPresent span { + background-color: #CCC; +} +.FieldPickerPopup .fpFilterFields label { + font-weight: bold; + font-size: 11px; +} +.FieldPickerPopup .fpFieldListContainerOuter { + _background: url(/static/img/skins/default/field_list_header.png) repeat-x 0 0; +} +.FieldPickerPopup .fpFieldListContainerOuter thead tr { + background-position: left -5px; +} +.FieldPickerPopup .fpFieldListContainerOuter th span { + background-color: transparent; + background-position: -67px -441px; +} +.FieldPickerPopup .fpFieldListContainerOuter +.headerSortUp span { + background-position: -67px -379px; +} +.FieldPickerPopup .fpFieldListContainerOuter th.headerSortDown span { + background-position: -67px -360px; +} +.FieldPickerPopup .fpFieldList tr.fieldSelected td.fpFieldTerm { + color:#999; +} +.FieldPickerPopup .fpFieldList tr.fieldSelected td.fpAddTermCell span { + background-color: #CCC; +} + +.fpFieldList .splHeader { + background-image: url(/static/img/skins/default/overlay_gradient_28.png); + _background-image: none; +} + + + +/* adding this class on hover via jquery, handles row highlighting and graph icon */ +.FieldPickerPopup .fpFieldList tbody tr:hover, .FieldPickerPopup .fpFieldList tbody tr.mouseoverHighlight { + background-color: #f5e998; +} +.FieldPickerPopup .fpFieldList tbody tr:hover .fpFieldListSecond a, +.FieldPickerPopup .fpFieldList tbody tr.mouseoverHighlight .fpFieldListSecond a { + background: url(/static/img/skins/default/graph_icon.png) no-repeat center right; +} + + + + +/*** SearchBar for DEFAULT.CSSS ***/ + +table .SearchBar .searchFieldWrapper { +} + +table.mainSearchControlsTable .SearchBar .searchFieldWrapper { + border: 1px solid #5e8d3d; + background-color: #5e8d3d; + + + border-right-width: 0; + -moz-border-radius-topright: 0; + -moz-border-radius-bottomright: 0; + -webkit-border-top-right-radius: 0; + -webkit-border-bottom-right-radius: 0; + border-bottom-right-radius: 0; + border-top-right-radius: 0; + border-bottom-right-radius: 0; + background: #73a550 url(/static/img/skins/default/search_bar.png); + _background: #73a550; + _background-image: none; +} + +.SearchBar .searchFieldWrapperInner { + border-color: #a0c288; +} + +.SearchBar label { + color: #bbb; +} + +.SearchBar .assistantActivator { + background-color:#689549; + background-image: url(/static/img/skins/default/overlay_gradient_28.png); + _background-image: none; + background-repeat: repeat-x; +} +.SearchBar .assistantEnabled span.assistantAutoOpener { + color: #fff; +} +.SearchBar .assistantEnabled span.saHandle { + background:transparent url(/static/img/skins/default/bg_resizer_white.png) center no-repeat; + _background:transparent url(/static/img/skins/default/bg_resizer_white.gif) center no-repeat; +} +.SearchBar h4 { + color: #73A550; +} +.sakeywordCount{ + background-color: #fff; + color: #333; +} +.saKeywordSelected { + background-color: #f5e998; +} +.saKeywordSelected .sakeywordCount{ + background-color: #f5e998; +} + +.sakeyword:hover { + background-color: #EDEDE7; +} +.sakeyword:hover .sakeywordCount{ + background-color: #EDEDE7; +} +.splSearchControls-inline { + background-repeat: repeat-x; + background-position: bottom; + _background-image: none; +} +.SearchBar .assistantWrapperEnabled { + -webkit-box-shadow: 2px 2px 3px 0px rgba(0, 0, 0, 0.4); + -moz-box-shadow: 2px 2px 3px 0px rgba(0, 0, 0, 0.4); + box-shadow: 2px 2px 3px 0px rgba(0, 0, 0, 0.4); + border-top:1px solid #A0C288 ; +} + +.SearchBar .assistantInner { + background: #edede7 url(/static/img/skins/default/bg_search_assistant.png) left top repeat-y; + zoom:1; +} +.SearchBar .assistantInnerHelpOnly { + background-color: #edede7; + background-image: none; +} + + +.SearchBar .assTab .splIcon { + background-position: 0 -582px; + background-color: transparent; +} +.SearchBar .assistantWrapperEnabled .assTab .splIcon { + background-position: 0 -562px; +} + + +.SearchBar .saHelpWrapper { + border-left-color: #fff; +} +.SearchBar .sakeyword em { + font-style: normal; + font-weight: bold; + color: #046a89; +} +.SearchBar .saNotice { + background-color: #f5e998; + border-color: #CCC !important; +} +.SearchBar .error { + background-color: #f5e998; + border-color: #CCC !important; + color: #900; + background-image: none; +} + +.introstep { + color: #333; +} +.intro code { + color: #73A550; +} +.SearchBar .intro ul li{ + list-style-type: disc; +} + +.splView-flashtimeline .JobStatus { + background: #EDEDE7 url('/static/img/skins/default/overlay_bottomgradient_32.png') repeat-x bottom left; + _background-image: none; + border-bottom-color: #a4a4a4; +} + + +.splView-flashtimeline .ChartTypeFormatter { + border-bottom: 1px solid #ccc; +} + +.splView-flashtimeline .ShowHideHeader div.secondary h2 { + font-size: 12px; +} +.splView-flashtimeline .ShowHideHeader { + border-top-width: 2px; +} + + +div.splSearchFormatChart-tabs ul li.selected .linkSwitcherSelectedIcon { + background: transparent url(/static/img/skins/default/splIcons.gif) -68px -346px no-repeat; +} + +/* TimeRangePicker */ +.TimeRangePicker .timeRangeActivatorWrapper { + background-image: url(/static/img/skins/default/overlay_topgradient_white.png); + background-repeat: repeat-x; + background-color:#d5d5d1; + _background-image:url(/static/img/skins/default/backgrounds_ie6.gif); + -moz-border-radius: 5px; + -webkit-border-radius: 5px; + border-radius: 5px; +} + + +table.mainSearchControlsTable .TimeRangePicker .timeRangeActivator { + padding-top: 3px; +} + +table.mainSearchControlsTable .TimeRangePicker .timeRangeActivatorWrapper { + border: 1px solid #5e8d3d; + border-left-width: 0; + -moz-border-radius: 0; + -webkit-border-radius: 0; + border-radius: 0; + + color: #fff; + + background: #659c40 url(/static/img/skins/default/search_bar.png); + _background-image: url('/static/img/skins/default/green_search_button.png'); + _background-repeat: no-repeat; + _background-position: 0px -74px; + + font-size: 12px; + height: 26px; +} + +/* IE6 & 7 FIX*/ +.mainSearchControlsTable .timeRangeActivatorWrapper{*position:relative;} +.mainSearchControlsTable .dropDown +{ + *position:absolute; + *top:0px; + *right:10px; +} +/*IE7 double input border*/ +*+html .mainSearchControlsTable .SubmitButton fieldset{border:1px solid #5E8D3D ;} +*+html .mainSearchControlsTable .SubmitButton input { + border:0; + height: 26px; + width: 42px; +} +/*IE7 min width */ +*+html .mainSearchControlsTable .timeRangeActivator { + min-width:100px; + width:expression(this.currentStyle.getAttribute('minWidth')); +} + +table.mainSearchControlsTable .TimeRangePicker .timeRangeActivatorWrapper:hover, +table.mainSearchControlsTable .TimeRangePicker .timeRangeActivatorWrapper:focus { + background-color: #4e7830; + text-decoration: none; +} + +table.mainSearchControlsTable .TimeRangePicker .timeRangeActivatorWrapper .dropDown { + background-position: -27px -367px; + margin-top: 11px; +} + + +.trpCustomDateTime .rangeType { + border-bottom: 1px solid #CCC; +} +.trpCustomDateTime input.disabled { + background-color: #DDD; + border-color:#DDD; + color:#666; +} +.trpCustomDateTime .earliestDateTime, +.trpCustomDateTime .latestDateTime { + border: 1px solid #ccc; +} +.trpCustomDateTime .dateTimeDisabled { + background-color: #f4f4f1; + border-color:#f4f4f1; + color:#666; +} +.trpCustomDateTime .dateTimeDisabled input { + background:transparent; +} +.trpCustomDateTime input.customDate { + border: none; + background: transparent; +} +.trpCustomDateTime div.outputString { + background-color: #f4f4f1; + border: 1px solid #f4f4f1; + color:#333; +} + + +/*** Report builder ***/ + +.report_builder_format_report .viewHeader { + border: 0; +} + +.report_builder_format_report .JobStatus { + border: 0; +} +.ShowHideHeader { + border-top-width: 1px; + border-top-style: solid; +} + +/*** Advanced charting ***/ + +.splView-charting .ResultsHeader .splHeader-primary { + background-image: none; +} + +/*** Switchers ***/ + +/* ButtonSwitcher */ +.ButtonSwitcher ul li.selected .splIcon-events-list { + background-position: 0 -740px; +} +.ButtonSwitcher ul li.selected .splIcon-events-table { + background-position: 0 -760px; +} +.ButtonSwitcher ul li.selected .splIcon-results-table { + background-position: 0 -780px; +} +.ButtonSwitcher ul li.selected .splIcon-results-chart { + background-position: 0 -800px; +} +.ButtonSwitcher ul li.disabled .splIcon-events-list { + background-position: -13px -740px; +} +.ButtonSwitcher ul li.disabled .splIcon-events-table { + background-position: -13px -760px; +} +.ButtonSwitcher ul li.disabled .splIcon-results-table { + background-position: -13px -780px; +} +.ButtonSwitcher ul li.disabled .splIcon-results-chart { + background-position: -13px -800px; +} +.ButtonSwitcher ul li.disabled a * { + cursur:default; +} + + +.ButtonSwitcher ul li { + border-color: #fff; + -moz-border-radius: 3px; + -webkit-border-radius: 3px; + border-radius: 3px; +} + +.ButtonSwitcher ul li.selected, .ButtonSwitcher ul li.selected:hover { + background-color: #999; + -webkit-box-shadow: inset 1px 1px 1px 0px #333333; + -moz-box-shadow: inset 1px 1px 1px 0px #333333; + box-shadow: inset 1px 1px 1px 0px #333333; +} + +/* Link Switcher */ +.LinkSwitcher a { + font-size: 12px; +} +.LinkSwitcher ul li.selected a { + color:#333; + font-weight: bold; + text-decoration:none; +} + +/* ShowHideHeader */ +.ShowHideHeader div.secondary { + background-image: none; +} +.ShowHideHeader h2 span.splIcon-triangle { + background-position: -67px -367px; +} +.ShowHideHeader div.secondary h2 { + font-size: 11px; + font-weight: normal; +} +.ShowHideHeader div.secondary h2 span.splIcon-triangle { + background-position: -87px -367px; +} +.ShowHideHeader div.secondary h2:hover { + text-decoration:underline; +} +.ShowHideHeader h2.closed span.splIcon-triangle { + background-position: -67px -407px; +} +.ShowHideHeader div.secondary h2.closed span.splIcon-triangle { + background-position: -87px -407px ; +} + +/* TabSwitcher */ +.TabSwitcher { + background-color: #bdbdb7; +} +.TabSwitcher ul li { + background: #666 url(/static/img/skins/default/tab_switcher_rounded_corners.gif) no-repeat 0 -68px; +} +.TabSwitcher ul li a { + font-size: 12px; + background: #666 url(/static/img/skins/default/tab_switcher_rounded_corners.gif) no-repeat right -102px; + color: #FFF; +} +.TabSwitcher ul li.selected { + background-color: #FFF; + background: #FFF url(/static/img/skins/default/tab_switcher_rounded_corners.gif) no-repeat 0 0; +} +.TabSwitcher ul li.selected a { + color: #333; + background: #FFF url(/static/img/skins/default/tab_switcher_rounded_corners.gif) no-repeat right -34px; +} + +/* progress bar */ + +.JobProgressIndicator .splBarGraph { + background-image:url(/static/img/skins/default/overlay_innershadow_4.png); + _background-image: none; +} + +.JobProgressIndicator .splBarGraphBar { + background-image:url(/static/img/skins/default/overlay_gradient_4.png); + _background-image: none; +} + + + +/********************************** +Interactive Field Extractor +***********************************/ +.ifxHelpColumn { + background-color:#E5F2F5; +} + +.ifxHelpColumn h4 { + color:#111 +} + + +/********************************** +hacks +***********************************/ + +/* safari focus outline */ +/* +*:focus {outline: 0;} +*/ + diff --git a/apps/eventid/bin/ev_process_proc.py b/apps/eventid/bin/ev_process_proc.py new file mode 100755 index 00000000..3f5eccf2 --- /dev/null +++ b/apps/eventid/bin/ev_process_proc.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python + +import csv +import sys +import re + + +# arp.exe,Target Discovery,Obtains information about hosts on the local broadcast domain +# New_Process_Name = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe +# C:\Windows\System32\wbem\WmiPrvSE.exe + +def process_interesting(full_path_process): + try: + process_path_elements = full_path_process.split("\\") + process = process_path_elements[len(process_path_elements)-1] + return process + except: + return full_path_process + +def main(): + if len(sys.argv) != 3: + print "Usage: python ev_process_proc.py [full_path_process] [process]" + print sys.argv[1] + print len(sys.argv) + sys.exit(1) + + full_path_process = sys.argv[1] + process = sys.argv[2] + + infile = sys.stdin + outfile = sys.stdout + + r = csv.DictReader(infile) + header = r.fieldnames + + w = csv.DictWriter(outfile, fieldnames=r.fieldnames) + w.writeheader() + + for result in r: + if result[full_path_process]: + result[process] = process_interesting(result[full_path_process]) + if result[process]: + w.writerow(result) + +main() diff --git a/apps/eventid/bin/ev_process_xml_parameters.py b/apps/eventid/bin/ev_process_xml_parameters.py new file mode 100755 index 00000000..b6ec9a79 --- /dev/null +++ b/apps/eventid/bin/ev_process_xml_parameters.py @@ -0,0 +1,48 @@ +#!/usr/bin/env python + +import csv +import sys +import re +import xml.etree.ElementTree as ET + +# Windows Modules Installerstopped540072007500730074006500640049006E007300740061006C006C00650072002F0031000000 + +def process_xml(xml_info): + try: + xml_result = "" + root = ET.fromstring(""+xml_info+"") + for child in root: + #xml_result = xml_result + child.tag + child.attrib + child.text+"\n" + xml_result = xml_result + child.text + "@" + #xml_result = xml_result + child.attrib + "\n" + return xml_result + except: + return "Error: "+xml_info + +def main(): + if len(sys.argv) != 3: + print "Usage: python ev_process_xml_parameters.py [raw_xml_data] [extracted_xml_data]" + print sys.argv[1] + print len(sys.argv) + sys.exit(3) + + raw_xml_data = sys.argv[1] + extracted_xml_data = sys.argv[2] + + infile = sys.stdin + outfile = sys.stdout + + r = csv.DictReader(infile) + header = r.fieldnames + + w = csv.DictWriter(outfile, fieldnames=r.fieldnames) + w.writeheader() + + for result in r: + if result[raw_xml_data]: + result[extracted_xml_data] = process_xml(result[raw_xml_data]) + #result[extracted_xml_data] = raw_xml_data + if result[extracted_xml_data]: + w.writerow(result) + +main() diff --git a/apps/eventid/default/app.conf b/apps/eventid/default/app.conf new file mode 100644 index 00000000..34a2de47 --- /dev/null +++ b/apps/eventid/default/app.conf @@ -0,0 +1,22 @@ +###################################################### +# +# Splunk_EventId.Net +# +# Copyright (C) 2016-2018 Firegen Analytics Inc All Rights Reserved. +# +###################################################### +[install] +is_configured = 0 +build = 1 + +[ui] +is_visible = 1 +label = EventID.Net + +[launcher] +author = adigrio +description = Dashboards for Windows event logs and links to www.eventid.net +version = 1.5.1 + +[package] +id = eventid diff --git a/apps/eventid/default/data/ui/nav/default.xml b/apps/eventid/default/data/ui/nav/default.xml new file mode 100644 index 00000000..9a740e43 --- /dev/null +++ b/apps/eventid/default/data/ui/nav/default.xml @@ -0,0 +1,14 @@ + \ No newline at end of file diff --git a/apps/eventid/default/data/ui/views/README b/apps/eventid/default/data/ui/views/README new file mode 100644 index 00000000..d518a88b --- /dev/null +++ b/apps/eventid/default/data/ui/views/README @@ -0,0 +1 @@ +Add all the views that your app needs in this directory diff --git a/apps/eventid/default/data/ui/views/audit_events.xml b/apps/eventid/default/data/ui/views/audit_events.xml new file mode 100644 index 00000000..f87d0518 --- /dev/null +++ b/apps/eventid/default/data/ui/views/audit_events.xml @@ -0,0 +1,405 @@ +
+ + Click on the event to check it on www.eventid.net +
+ + + + -24h@h + now + + + + + All + * + ( + ) + host=" + " + OR + + `event_sources` ("Audit Success" OR "Audit Failure") | stats count by host + $interval.earliest$ + $interval.latest$ + + host + host + + + + Audit Failure,Audit Success + Failure + Success + ( + ) + " + " + OR + Audit Type + Audit Type + Audit Failure,Audit Success + + + + * + + + + Yes + No + Message!="*privilege*" + + + + Yes + No + Account_Name != "*$$*" + Account_Name != "*$$*" + +
+ + + Audit events over time + + + `event_sources` ("Audit Success" OR "Audit Failure") AND $Computer$ AND $keyword$ $nopriv$ $nocomputer$ $Audit_Type$ +| fillnull +| timechart count + $interval.earliest$ + $interval.latest$ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Accounts with 3 or more failed logons + + + `event_sources` Failure_Reason=* ("Audit Failure") AND $Computer$ AND $keyword$ $nopriv$ Message != "*privilege*" Account_Name != "*$*" +| table host, Account_Name, Failure_Reason +| stats count by Account_Name +| where count > 2 + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Audit Failure events by computer + + + `event_sources` "Audit Failure" AND $Computer$ AND $keyword$ $nocomputer$ $nopriv$ +| fillnull +| stats count by host + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Distinct Accounts + + + `event_sources` AND $Computer$ AND $keyword$ $nopriv$ $nocomputer$ TaskCategory=Logon $Audit_Type$ +| stats dc(Account_Name) + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + + + Logon Successful Audits + + + `event_sources` AND $keyword$ $nopriv$ $nocomputer$ TaskCategory=Logon +| stats count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + Logon Audit Failure events + + + `event_sources` AND $Computer$ AND $keyword$ $nocomputer$ $nopriv$ Failure_Reason=* ("Audit Failure") +| stats count + $interval.earliest$ + $interval.latest$ + + + + + + + + + search?q=`event_sources` Failure_Reason=* * ("Audit Failure") AND $Computer$ AND $keyword$ Message != "*privilege*" Account_Name != "*$*" | stats count&earliest=$interval.earliest$&latest=$interval.latest$ + + + + + New Local Admins + + + `event_sources`AND $Computer$ AND $keyword$ $nocomputer$ $nopriv$ +| transaction Security_ID maxspan=180m +| search EventCode=4720 OR (EventCode=4732 Administrators) +| stats count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + + + + + Events Summary + + + `event_sources` AND $Computer$ AND $keyword$ $nopriv$ $nocomputer$ $Audit_Type$ +| fillnull +| eval Type=if(Keywords=="Audit Success",Keywords, Type) +| eval Type=if(Keywords=="Audit Failure",Keywords, Type) +| stats earliest(_time) as First latest(_time) as Last max(Message) as Sample_Message count by host, EventCode, Type +| sort -count host, EventCode, Type, Sample_message +| rename EventCode as "EventId" +| fieldformat First=strftime(First,"%x %X") | fieldformat Last=strftime(Last,"%x %X") + $interval.earliest$ + $interval.latest$ + + + + + + + + + https://www.eventid.net/display.asp?eventid=$row.EventId$&source=$row.SourceName$&app=SplunkEvId + +
+ + + + + Audit Failure Events + + + `event_sources` AND $Computer$ AND $keyword$ $nocomputer$ $nopriv$ AND "Audit Failure" +| fillnull +| eval user=mvindex(Account_Name,1) +| table _time, host, EventCode, Message, user, Failure_Reason, Source_Workstation, Caller_Process_Name +| rename EventCode as "EventId", Caller_Process_Name as Process + $interval.earliest$ + $interval.latest$ + + + + + + +
+ + + + + Accounts successfully logged on + + + `event_sources`AND $Computer$ AND $keyword$ $nocomputer$ $nopriv$ AND TaskCategory=Logon AND NOT Account_Name="*ANONYMOUS*" +| timechart count + $interval.earliest$ + $interval.latest$ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Audit Success Events + + + `event_sources` AND $Computer$ AND $keyword$ $nopriv$ $nocomputer$ "Audit Success" +| fillnull +| eval Type=if(Keywords=="Audit Success",Keywords, Type) +| eval Type=if(Keywords=="Audit Failure",Keywords, Type) +| eval user=mvindex(Account_Name,1) +| table _time, host, EventCode, Message, user, Source_Workstation, Process_Name +| rename EventCode as "EventId", Process_Name as Process + $interval.earliest$ + $interval.latest$ + + + + + + +
+ + + + + Audit events - drill down option + + + `event_sources` $Audit_Type$ AND $Computer$ AND $keyword$ $nopriv$ $nocomputer$ +| fillnull +| eval Type=if(Keywords=="Audit Success",Keywords, Type) +| eval Type=if(Keywords=="Audit Failure",Keywords, Type) +| eval user=mvindex(Account_Name,1) +| table _time, host, EventCode, Type, Message, user + $interval.earliest$ + $interval.latest$ + + host, LogName, EventCode, SourceName, Type, Message, user + + + + + + + +
\ No newline at end of file diff --git a/apps/eventid/default/data/ui/views/documentation.xml b/apps/eventid/default/data/ui/views/documentation.xml new file mode 100644 index 00000000..286b5a22 --- /dev/null +++ b/apps/eventid/default/data/ui/views/documentation.xml @@ -0,0 +1,55 @@ + + + + + Introduction + +

Welcome to the EventID.Net Windows Event Logs app!

+ + + + + + Windows Event Log App sources of information + +

The Windows Event Log App assumes that Splunk is collecting information from Windows servers and workstation via one of the following methods: +

+

+ +

All these methods will collect the events and either collect them in the "wineventlog" Splunk index or record them in the default index with source the source set as "*WinEventLog*" (notice the wildcards). The app analyzes the entries matching these criteria (index="wineventlog" OR source=*WinEventLog*). This matches the defaults used by the Universal Forwarder, the collection of local Windows event logs and the collection via WMI.

+ +

In order to create the proper indexes, we recommend the installation of the Splunk Add-on for Microsoft Windows app.

+ +

To collect the logs from remote computers without installing the Universal Forwarded on each computer, configure the forwarding of event logs to central location using the Windows built-in event forwarding. See Configure Computers to Forward and Collect Events for details on how to configure a computer as a collector of logs.

+ + + + + + + Additional information and troubleshooting + +

If no data is displayed, please verify that the Universal Forwarder is installed properly and that the all the Windows event logs are sent to the "wineventlog" index (or the WinEventLog* sources).

+ +

If the data is stored in a different index, the user can update the macros.conf [event_sources] section by using the application setup.

+ +

The Interesting Processes section from the Processes dashboard is partially based on a presentation by Michael Gough from www.malwarearchaeology.com: "The Top 10 Windows Event ID's Used To Catch Hackers In The Act". See for the presentation slides and information on how to enable the auditing of processes, including command-line based ones. The list of "interesting processes" is based on a study by JPCERT CC (Japan Computer Emergency Response Team Coordination Center) on detecting lateral movement through tracking of event logs. The list is stored in C:\Program Files\Splunk\etc\apps\eventid\lookups\interesting_processes.csv and it can be adjusted with a text editor if needed. For full functionality the audit of the command line arguments has to be enabled as described in Command Line Process Auditing

+ +

The XML dashboard is design to report Windows events rendered from the XML by using the renderXML stanza. The renderXML option reduced the volume of data to about 25% of the regular events, however some details such as the full description of the event are no longer recorded. See Feature Overview: XML Event Logs for more details.

+ +

Each of the dashboard can be set as an alarm (i.e. notifications when a certain number of failed logins are recorded, when certain processes are executed, etc).

+ +

Send any suggestions and questions to support@altairtech.ca. We can also provide advice in setting up the Splunk receiver for the Universal Forwarder.

+ +

We publish the most current version of EventID.Net Windows Event Logs Splunk app on www.eventid.net. Splunk may takes weeks or months to certify a new version.

+ + + + + + \ No newline at end of file diff --git a/apps/eventid/default/data/ui/views/eventid.xml b/apps/eventid/default/data/ui/views/eventid.xml new file mode 100644 index 00000000..27f7ba54 --- /dev/null +++ b/apps/eventid/default/data/ui/views/eventid.xml @@ -0,0 +1,362 @@ +
+ + Click on the event to check it on www.eventid.net +
+ + + + -24h@h + now + + + + + Error,Warning + Error + Warning + Information + ( + ) + Type=" + " + OR + Type + Type + + + + Denial,Audit Failure + Audit Failure + Audit Success + ( + ) + " + " + OR + Audit Type + Audit Type + Audit Failure + + + + All + * + ( + ) + host=" + " + OR + + `event_sources` | stats count by host + $interval.earliest$ + $interval.latest$ + + host + host + + + + * + + + + none + + ( + ) + + SourceName!=" + " + + AND + None + + `event_sources` $Type$ AND $Computer$ AND $keyword$ | stats count by SourceName + $interval.earliest$ + $interval.latest$ + + SourceName + SourceName + +
+ + + Errors + + + `event_sources` Type="Error" AND $Computer$ AND $keyword$ | stats count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + + + Warnings + + + `event_sources` Type="Warning" AND $Computer$ AND $keyword$ | stats count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + + + Information + + + `event_sources` Type="Information" AND NOT ("Audit Success" OR "Audit Failure") AND $Computer$ AND $keyword$ | stats count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + search?q=`event_sources` Type="Information" | stats count&earliest=$interval.earliest$&latest=$interval.latest$ + + + + + Audit Failure + + + `event_sources` "Audit Failure" AND $Computer$ AND $keyword$ +| stats count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + /app/eventid/audit_events + + + + + Audit Success + + + `event_sources` Keywords="Audit Success" AND $Computer$ AND $keyword$ | stats count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + Logon Audit Failure + + + `event_sources` Failure_Reason=* ("Audit Failure") AND $Computer$ AND $keyword$ | eval user=mvindex(Account_Name,1) | stats count + -24h@h + now + + + + + + + + + /app/eventid/audit_events + + + + + + + Accounts with 3 or more failed logons + + + `event_sources` Failure_Reason=* * ("Audit Failure") AND $Computer$ AND $keyword$ | stats count by user | where count > 2 + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Top computers generating events + + + `event_sources` AND $Computer$ AND $keyword$ AND ($Audit_Type$ OR $Type$) +| eval SourceName = coalesce(SourceName,source) +| fillnull +| search $sourcetype_token$ +| stats count by host + $interval.earliest$ + $interval.latest$ + + + + + + /app/eventid/eventid?form.Computer=$row.host$ + + + + + + + Windows events over time + + + `event_sources` AND $Computer$ AND $keyword$ AND ($Audit_Type$ OR $Type$) +| timechart count + $interval.earliest$ + $interval.latest$ + + + + + + + + + + + + + + + + + + + Events Summary - Links to www.eventid.net + + + `event_sources` AND $Computer$ AND $keyword$ AND ($Audit_Type$ OR $Type$) +| eval SourceName = coalesce(SourceName,Provider) +| eval Type = coalesce(Type,Keyword) +| fillnull value="-" +| stats earliest(_time) as First latest(_time) as Last count by host, EventCode, SourceName, Type +| sort -count host, EventCode, SourceName, Type +| rename EventCode as "EventId" +| fieldformat First=strftime(First,"%x %X") +| fieldformat Last=strftime(Last,"%x %X") + $interval.earliest$ + $interval.latest$ + + + + + + + + + https://www.eventid.net/display.asp?eventid=$row.EventId$&source=$row.SourceName$&app=SplunkEvId + +
+ + + + + Events List + + + `event_sources` AND $Computer$ AND $keyword$ AND ($Audit_Type$ OR $Type$) +| eval SourceName = coalesce(SourceName,Provider) +| eval Type = coalesce(Type,Keyword) +| fillnull +| table _time, host, EventCode, SourceName, Type, Message +| rename EventCode as "EventId" + $interval.earliest$ + $interval.latest$ + + + + + + + + + + +
\ No newline at end of file diff --git a/apps/eventid/default/data/ui/views/interesting_events.xml b/apps/eventid/default/data/ui/views/interesting_events.xml new file mode 100644 index 00000000..03c08a86 --- /dev/null +++ b/apps/eventid/default/data/ui/views/interesting_events.xml @@ -0,0 +1,55 @@ +
+ + Click on the event to check it on www.eventid.net +
+ + + + -24h@h + now + + + + + All + * + ( + ) + ComputerName=" + " + OR + + `event_sources` | stats count by ComputerName + $interval.earliest$ + $interval.latest$ + + ComputerName + ComputerName + + + + * + +
+ + + Interesting Events + + + `event_sources` AND $Computer$ AND $keyword$ | lookup interesting_events_lookup event_id AS EventCode, source AS SourceName OUTPUT source,description | search description="*" | table _time, ComputerName, EventCode, SourceName, Type, Message,description | rename EventCode as "EventId", description as "Why is it interesting?" + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + +
+ + +
\ No newline at end of file diff --git a/apps/eventid/default/data/ui/views/interesting_processes.xml b/apps/eventid/default/data/ui/views/interesting_processes.xml new file mode 100644 index 00000000..76aa680f --- /dev/null +++ b/apps/eventid/default/data/ui/views/interesting_processes.xml @@ -0,0 +1,189 @@ +
+ + List of processes identified through event id 4688 and listed in the www.eventid.net list of processes that may indicate suspicious activity. To generate event id 4688, a system requires the audit of process creation. See the documentation for more details. +
+ + + + -24h@h + now + + + + + All + * + ( + ) + ComputerName=" + " + OR + + `event_sources` (EventCode=4688) | stats count by ComputerName + $interval.earliest$ + $interval.latest$ + + ComputerName + ComputerName + + + + All + * + ( + ) + New_Process_ID=" + " + OR + + `event_sources` (EventCode=4688) | stats count by New_Process_ID + $interval.earliest$ + $interval.latest$ + + New_Process_ID + New_Process_ID + + + + All + * + ( + ) + Creator_Process_ID=" + " + OR + + `event_sources` (EventCode=4688) | stats count by Creator_Process_ID + $interval.earliest$ + $interval.latest$ + + Creator_Process_ID + Creator_Process_ID + + + + * + + + + Yes + No + Account_Name != "*$*" + Account_Name != "*$*" + + + + Yes + No + New_Process_Name = "*" + New_Process_Name = "*" + +
+ + + Interesting Processes + + + `event_sources` AND $Computer$ AND $keyword$ $nocomputer$ $creator$ $process_id$ $nocmdpowershell$ (EventCode=4688) | lookup processlookup full_path_process as New_Process_Name OUTPUT process | lookup interesting_process_lookup process OUTPUT Category,Process_Details | search Category="*" | table _time, host, Account_Name, Process_Command_Line, process,Category,Process_Details, New_Process_ID, +Creator_Process_ID | rename host as Server,process as Process,Process_Details as "Interesting Process Details" + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + +
+ + + + + Last 100 Processes + + + `event_sources` (EventCode=4688) AND $Computer$ AND $keyword$ $nocomputer$ $creator$ $process_id$ $nocmdpowershell$ +| head 100 +| table _time, host,Account_Name, New_Process_Name,Process_Command_Line, New_Process_ID, +Creator_Process_ID + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + +
+ + + + + Top Processes + + + `event_sources` (EventCode=4688) AND $Computer$ AND $keyword$ $nocomputer$ $creator$ $process_id$ $nocmdpowershell$ | stats count by host, New_Process_Name | table host, New_Process_Name,count | sort -count | rename count as Count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + +
+ + + + + Least Common Processes + + + `event_sources` (EventCode=4688) AND $Computer$ AND $keyword$ $nocomputer$ $creator$ $process_id$ $nocmdpowershell$ | stats count by host, New_Process_Name | table host, New_Process_Name,count | sort count| rename count as Count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + +
+ + + + + Unusually Long CLI Commands + + + `event_sources` (EventCode=4688) AND (ComputerName="*") AND * Account_Name != "*$$*" (Creator_Process_ID="*") (New_Process_ID="*") New_Process_Name = "*" | head 100 | table _time, host,Account_Name, New_Process_Name,Process_Command_Line, New_Process_ID, +Creator_Process_ID + -24h@h + now + 1 + + + + + + + + +
+ + +
\ No newline at end of file diff --git a/apps/eventid/default/data/ui/views/users_and_groups.xml b/apps/eventid/default/data/ui/views/users_and_groups.xml new file mode 100644 index 00000000..5171c5b6 --- /dev/null +++ b/apps/eventid/default/data/ui/views/users_and_groups.xml @@ -0,0 +1,225 @@ +
+ + Users and Groups Activities +
+ + + + -24h@h + now + + + + + * + * + +
+ + + Users Created + + + `event_sources` eventtype=windows_account_created $keyword$ +| timechart count + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Attempts to login with disabled accounts + + + `event_sources` name="*currently disabled*" $keyword$ +| eval domain=mvindex(Account_Domain,1) +| eval source_computer = coalesce(Workstation_Name,src_ip) +| eval domain = coalesce(domain,src_nt_domain) +| table _time,host,domain,user,source_computer + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + +
+ + + + + Users Added to Domain Admins or Enterprise Admins + + + `event_sources` name="A member was added to a security-enabled *" AND ("Enterprise Admins" OR "Domain Admins") $keyword$ +| rename dest_nt_domain as domain, EventCode as "event id", Display_Name as "user name",host as server +| dedup _time,user +| eval added_by=mvindex(Security_ID,0) +| eval user=mvindex(Security_ID,1) +| table _time, server,domain, user,added_by + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + +
+ + + Users Added to local Administrators + + + `event_sources` name="A member was added to a security-enabled local group" AND user_group="Administrators" $keyword$ +| rename dest_nt_domain as domain, EventCode as "event id", Display_Name as "user name",host as server +| eval added_by=mvindex(Security_ID,0) +| eval user=mvindex(Security_ID,1) +| table _time, server,domain, user,added_by + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + +
+ + + + + Users Created + + + `event_sources` eventtype=windows_account_created +| rename dest_nt_domain as domain, EventCode as "event id", Display_Name as "user name",host as server +| dedup _time,user +| eval created_by=mvindex(Account_Name,0) +| table _time, server,domain, user,"user name", created_by +| sort _time + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + +
+ + + Users Deleted + + + `event_sources` AND eventtype=windows_account_deleted $keyword$ +| eval deleted_by=mvindex(Account_Name,0) +| table _time, host, user,deleted_by +| sort _time + $interval.earliest$ + $interval.latest$ + 1 + + + +
+ + + + + Groups Created + + + `event_sources` name="A security-enabled global group was created" +| dedup _time,Group_Name +| rename dest_nt_domain as domain, EventCode as "event id", user as "created_by",host as server +| table _time, server,domain,Group_Name, created_by +| sort _time + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + +
+ + + Groups Deleted + + + `event_sources` name="A security-enabled global group was deleted" $keyword$ +| rename dest_nt_domain as domain, EventCode as "event id", user as "Deleted by",host as server +| table _time, server,domain,Group_Name, "Deleted by" +| sort _time + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + +
+ + +
\ No newline at end of file diff --git a/apps/eventid/default/data/ui/views/windows_event_sources.xml b/apps/eventid/default/data/ui/views/windows_event_sources.xml new file mode 100644 index 00000000..0eee2479 --- /dev/null +++ b/apps/eventid/default/data/ui/views/windows_event_sources.xml @@ -0,0 +1,120 @@ +
+ + Click on the event source to check it on www.eventid.net +
+ + + + -24h@h + now + + + + + Error + ( + ) + Type=" + " + OR + + `event_sources`| stats count by Type + $earliest$ + $latest$ + + Type + Type + + + + All + * + ( + ) + ComputerName=" + " + OR + + `event_sources` | stats count by ComputerName + $earliest$ + $latest$ + + ComputerName + ComputerName + + + + * + +
+ + + Event sources + + Click on the source to look it up on www.eventid.net + + `event_sources` $Type$ AND $Computer$ AND $keyword$ | stats count as TotalEvents by SourceName + + + https://www.eventid.net/source-name-$row.SourceName$.htm + + + + + + + + + + Event sources percentages + + + `event_sources` $Type$ AND $Computer$ AND $keyword$ | stats count by SourceName + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Matching events - drill down option + + + `event_sources` $Type$ AND $Computer$ AND $keyword$| table _time, ComputerName, LogName, EventCode, SourceName, Type, Message, UserName + + + + + + + + + + + ["ComputerName","LogName","EventCode","SourceName","Type","Message","UserName"] + + + +
\ No newline at end of file diff --git a/apps/eventid/default/data/ui/views/windows_events_xml_source.xml b/apps/eventid/default/data/ui/views/windows_events_xml_source.xml new file mode 100644 index 00000000..4191ea98 --- /dev/null +++ b/apps/eventid/default/data/ui/views/windows_events_xml_source.xml @@ -0,0 +1,208 @@ +
+ + Dashboard for events collected using the renderXML option +
+ + + + -24h@h + now + + + + + Error + Warning + Information + Audit + ( + ) + Level=" + " + OR + Level + Level + 3,2 + 2,3 + + + + All + * + ( + ) + Computer=" + " + OR + + `event_sources_xml` | stats count by Computer + $interval.earliest$ + $interval.latest$ + + Computer + Computer + + + + * + + + + none + + ( + ) + + Name!=" + " + + AND + None + + `event_sources_xml` $Type$ AND $Computer$ AND $keyword$ | rex field=Name mode=sed "s/\'//g" | stats count by Name + $interval.earliest$ + $interval.latest$ + + Name + Name + +
+ + + Windows events over time + + + `event_sources_xml` +| search $Type$ $Computer$ AND $keyword$ +| lookup xmleventtype_lookup xml_type AS Level OUTPUT event_type +| timechart count by event_type + $interval.earliest$ + $interval.latest$ + + + + + + + + + + + + Top computers generating events + + + `event_sources_xml` | fillnull value="-" | search $Computer$ AND $keyword$ | stats count by Computer + $interval.earliest$ + $interval.latest$ + + + + + + + + Accounts with 3 or more failed logons + + + `event_sources_xml` eventtype=windows_logon_failure | stats count by user | where count > 2 + $interval.earliest$ + $interval.latest$ + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Logon Audit Failure events + + + `event_sources_xml` eventtype=windows_logon_failure | eval user=mvindex(Account_Name,1) | stats count + $interval.earliest$ + $interval.latest$ + + + + + + + + + + Events Summary + + + `event_sources_xml` | search $Type$ $Computer$ | lookup xmleventtype_lookup xml_type AS Level OUTPUT event_type | rex field=Name mode=sed "s/\'//g" | stats earliest(_time) as First latest(_time) as Last count by Computer,EventID,Name,Channel, event_type,eventtype | sort -count Computer,EventID,Name,Channel, event_type,eventtype | fieldformat First=strftime(First,"%x %X") | fieldformat Last=strftime(Last,"%x %X") | rename Channel as Log, Name as Source,event_type as Level,eventtype as Category + $interval.earliest$ + $interval.latest$ + + + + + + + + + https://www.eventid.net/display.asp?eventid=$row.EventId$&source=$row.SourceName$&app=SplunkEvId + +
+ + + Logon Audit Failure events + + + `event_sources_xml` eventtype=windows_logon_failure | table _time,Computer,EventID,user,WorkstationName,LogonType,name | rename name as Details + $interval.earliest$ + $interval.latest$ + + + + + + + +
+ + + + + Events List + + + `event_sources_xml` | search ($Type$) AND $Computer$ AND $keyword$ $sourcetype_token$ | rex field=Name mode=sed "s/\'//g" | lookup xmleventtype_lookup xml_type AS Level OUTPUT event_type | lookup xml_raw_data_lookup raw_xml_data as EventData_Xml OUTPUT extracted_xml_data | eval extracted_xml_data = split(extracted_xml_data,"@") | table _time,EventID,Name,Channel, event_type,eventtype, extracted_xml_data | rename Channel as Log, event_type as Level, eventtype as Category, Name as Source + $interval.earliest$ + $interval.latest$ + + + + + + + + + + +
\ No newline at end of file diff --git a/apps/eventid/default/macros.conf b/apps/eventid/default/macros.conf new file mode 100644 index 00000000..1cdd92f8 --- /dev/null +++ b/apps/eventid/default/macros.conf @@ -0,0 +1,8 @@ + +[event_sources] +definition = (index="wineventlog" OR source=*WinEventLog*) +iseval = 0 + +[event_sources_xml] +definition = index="wineventlog_xml" +disabled = 0 \ No newline at end of file diff --git a/apps/eventid/default/setup.xml b/apps/eventid/default/setup.xml new file mode 100644 index 00000000..b4cabbd0 --- /dev/null +++ b/apps/eventid/default/setup.xml @@ -0,0 +1,23 @@ + + + + + + + text + + + + + + + + text + + + + diff --git a/apps/eventid/default/transforms.conf b/apps/eventid/default/transforms.conf new file mode 100644 index 00000000..749c491c --- /dev/null +++ b/apps/eventid/default/transforms.conf @@ -0,0 +1,22 @@ +[interesting_process_lookup] +default_match = N/A +filename = eventid_interesting_processes.csv +max_matches = 1 + +[processlookup] +external_cmd = ev_process_proc.py full_path_process process +fields_list = full_path_process,process + +[xmleventtype_lookup] +default_match = N/A +filename = xml_event_types.csv +max_matches = 1 + +[xml_raw_data_lookup] +external_cmd = ev_process_xml_parameters.py raw_xml_data extracted_xml_data +fields_list = raw_xml_data,extracted_xml_data + +[interesting_events_lookup] +default_match = N/A +filename = eventid_interesting_events.csv +max_matches = 1 \ No newline at end of file diff --git a/apps/eventid/default/workflow_actions.conf b/apps/eventid/default/workflow_actions.conf new file mode 100644 index 00000000..bc177771 --- /dev/null +++ b/apps/eventid/default/workflow_actions.conf @@ -0,0 +1,10 @@ + +[Eventid.Net lookup] +display_location = event_menu +eventtypes = winapp +fields = $EventCode$,$SourceName$ +label = Lookup event id $EventCode$ on www.eventid.net +link.method = get +link.target = blank +link.uri = https://www.eventid.net/display.asp?eventid=$EventCode$&app=Splunk&source=$SourceName$ +type = link diff --git a/apps/eventid/license-eula.rtf b/apps/eventid/license-eula.rtf new file mode 100644 index 00000000..dd0f29b3 --- /dev/null +++ b/apps/eventid/license-eula.rtf @@ -0,0 +1,57 @@ +{\rtf1\ansi\ansicpg1252\deff0{\fonttbl{\f0\fswiss\fcharset0 Helvetica;}} +{\*\generator Msftedit 5.41.21.2508;} +{\info +{\title Splunk Software License Agreement} +{\*\company Splunk Inc.}}\viewkind4\uc1\pard\qc\lang1033\b\f0\fs22 SPLUNK SOFTWARE LICENSE AGREEMENT\par +\pard\b0\fs18\par +THIS SPLUNK SOFTWARE LICENSE AGREEMENT (THE "AGREEMENT") GOVERNS ALL SOFTWARE PROVIDED BY SPLUNK INC. ("SPLUNK") INCLUDING FREE SPLUNK SOFTWARE ("FREE SOFTWARE") AND SOFTWARE PURCHASED THROUGH SPLUNK'S ONLINE STORE OR OTHER CHANNELS ("PURCHASED SOFTWARE"), COLLECTIVELY THE SPLUNK SOFTWARE ("SOFTWARE") AND ANY AND ALL UPDATES, UPGRADES, AND MODIFICATIONS THERETO. CONFIRMATION OF YOUR ORDERS ("ORDER CONFIRMATION") WILL BE DEEMED INCORPORATED INTO AND MADE PART OF THIS AGREEMENT.\par +\par +YOU WILL BE REQUIRED TO INDICATE YOUR AGREEMENT TO THESE TERMS AND CONDITIONS IN ORDER TO DOWNLOAD THE SOFTWARE AND REGISTER WITH SPLUNK IN ORDER TO OBTAIN LICENSE KEYS NECESSARY TO COMPLETE THE INSTALLATION PROCESS FOR PURCHASED SOFTWARE. BY CLICKING ON THE "YES" BUTTON, DOWNLOADING OR INSTALLING THE SOFTWARE, OR USING ANY MEDIA THAT CONTAINS THE SOFTWARE, YOU ARE CONSENTING TO BE BOUND BY THIS AGREEMENT.\par +\par +IF YOU AGREE TO THESE TERMS ON BEHALF OF A BUSINESS, YOU REPRESENT AND WARRANT THAT YOU HAVE AUTHORITY TO BIND THAT BUSINESS TO THIS AGREEMENT, AND YOUR AGREEMENT TO THESE TERMS WILL BE TREATED AS THE AGREEMENT OF THE BUSINESS. IN THAT EVENT, "YOU" AND "YOUR" REFER HEREIN TO THAT BUSINESS.\par +\par +"Splunk Developer API" means the documentation and functionality enabling the creation of extensions to the Software. "Example Modules" means the source code and binary form of examples that use the Splunk Developer API. \par +\par +PURCHASED SOFTWARE TERM. Unless earlier terminated, this Agreement will be in effect perpetually for any Purchased Software. "Term" means the period in which the Agreement is in effect.\par +\par +PURCHASED SOFTWARE FREE TRIAL. Notwithstanding the foregoing, if the applicable Order Confirmation is limited to a free trial license, then the Term will be limited to the free trial period specified in the Order Confirmation, this Agreement and any license rights granted hereunder will automatically terminate at the end of the free trial period, and there will be no Renewal Term. Any license keys provided for a free trial will automatically expire and may cause the Software to become non-operational at the end of the free trial period. Provisions in this Agreement regarding License Fees, Maintenance and Support, and Warranty will not apply to free trials.\par +\par +PURCHASED SOFTWARE LICENSE. Subject to your compliance with the terms and conditions of this Agreement, including your payment of the license fees set forth in each Order Confirmation (the "License Fees"), Splunk grants you a nonexclusive, nontransferable, revocable, limited license during the Term to use the Software for which you have paid the applicable License Fees as set forth in your Order Confirmation(s), only for your internal business purposes (which shall include use by consultants, accountants, auditors and attorneys hired to perform services for you) and only subject to the following conditions: you may use each Splunk Server with an Enterprise license to index no more than the peak daily volume of uncompressed data for which you have paid the applicable License Fees as set forth in your Order Confirmation (the "Maximum Peak Daily Volume"). The Software will be configured to display warnings and/or cease indexing data when the Maximum Peak Daily Volume is reached.\par +\par +FREE SOFTWARE LICENSE. Subject to the terms and conditions of this Agreement, Splunk grants to You a non-exclusive, worldwide, fully-paid up copyright license to use the Free Splunk Software in binary form only and only subject to the following conditions: (i) to index no more than 500MB of peak daily volume of uncompressed data (the 'Maximum Peak Daily Volume') and only for your internal business purposes (which shall include use by consultants, accountants, auditors and attorneys hired to perform services for you). The Software will be configured to display warnings, reduce available functionality, and/or cease indexing data when the Maximum Peak Daily Volume is reached.\par +\par +EXTENSION LICENSE. Splunk further grants to You a non-exclusive, worldwide, fully-paid up copyright license to use the Splunk Developer API and Example Modules included with the Software solely for the purpose of developing extensions to access the Splunk API or Example Modules for Your use in conjunction with the Software (collectively, "Your Extensions"). You agree to assume full responsibility for the performance of Your Extensions, and shall indemnify, hold harmless, and defend Splunk (including all of its officers, employees, directors, subsidiaries, representatives, affiliates and agents) and Splunk's suppliers from and against any claims or lawsuits, including attorney's fees and expenses, that arise or result from Your Extensions pursuant to this Agreement. You retain title to and copyright for Your Extensions, subject to Splunk's title to and copyright for the Software, the Splunk Developer API, and the Example Modules as specified in Ownership and Copyrights, below. This Agreement does not grant you any distribution rights. If you want to distribute or provide to any third parties Your Extensions, you must first register as a Splunk application developer and agree to the Splunk Developer Agreement at http://www.splunk.com/goto/devagreement. You will not remove or change any Splunk copyright notices or branding included in the Splunk Software or required by Splunk's Identity Guidelines as set forth at http://www.splunk.com/goto/splunkpowered, Splunk Developer APIs, or Example Modules, and will include such notices and branding in each copy of Your Extensions, the Splunk Software, the Splunk Developer APIs, and the Examples Modules that you make or distribute.\par +\par +PURCHASED SOFTWARE RESTRICTIONS. You agree not to (i) use the Software except as expressly authorized in this Agreement and your Order Confirmation; (ii) copy the Software (except as required to run the Software and for reasonable backup purposes); (iii) modify, adapt, or create derivative works of the Software; (iv) rent, lease, loan, resell, transfer, sublicense (including but not limited to offering any of the functionality of the Software on a service provider, hosted or time sharing basis) or distribute the Software to any third party; (v) decompile, disassemble or reverse-engineer the Software or otherwise attempt to derive the Software source code; (vi) disclose to any third party the results of any benchmark tests or other evaluation of the Software, or (vii) authorize any third parties to do any of the above.\par +\par +FREE SOFTWARE RESTRICTIONS. You shall not (i) decompile, disassemble or reverse engineer the Free Software without the express written authorization of Splunk; (ii) modify, adapt, or create derivative works of the Free Software; (iii) rent, lease, loan, or resell the Free Software, the Splunk Developer API, Example Modules, or Your Extensions (including but not limited to offering the functionality of the Free Software on an applications service provider or time sharing basis), except as expressly permitted in the Splunkbase Application Developer Agreement; (iv) decompile, disassemble or reverse-engineer the Software or otherwise attempt to derive the Software source code; (v) disclose to any third party the results of any benchmark tests or other evaluation of the Software, or (vi) authorize any third parties to do any of the above.\par +\par +OWNERSHIP. Splunk and/or its licensors own all worldwide right, title and interest in and to the Software, including all worldwide intellectual property rights therein. You will not delete or in any manner alter the copyright, trademark, and other proprietary rights notices appearing in or on the Software as provided. All right, title, and interest in and to all copies the Splunk Developer API, and the Example Modules remains with Splunk and/or its licensors. The Software, Splunk Developer API, and Example Modules are copyrighted and protected by the laws of the United States and other countries, and international treaty provisions. You may not remove any copyright notices from the Software, the Splunk Developer API, or the Example Modules.\par +\par +PURCHASED SOFTWARE LICENSE AND FEES. In order to access and use the Software, you are required to pay to Splunk the License Fees in accordance with your Order Confirmation. The License Fees will be due and payable in accordance with the terms set forth in your Order Confirmation. Any failure to pay the License Fees in accordance with an Order Confirmation will result in automatic revocation and termination of this Agreement and all rights and licenses granted hereunder. All License Fees are non-refundable once paid.\par +\par +MAINTENANCE AND SUPPORT. Subject to your payment of the applicable annual maintenance and support fees set forth in your Order Confirmation (the "Support Fees"), Splunk will provide the level of support for the Purchased Software identified in your Order Confirmation in accordance with the support descriptions set forth on Splunk's website at www.splunk.com. Splunk is not obligated to support, update or upgrade the Free Software.\par +\par +PURCHASED SOFTWARE VERIFICATION AND AUDIT. At Splunk's written request, you will furnish Splunk with a certification signed by an officer of your company verifying that the Software is being used in accordance with the terms and conditions of this Agreement and the applicable Order Confirmations. Upon at least ten (10) days prior written notice, Splunk may audit your use of the Software to ensure that you are in compliance with the terms of this Agreement and the applicable Orders. Any such audit will be conducted during regular business hours at your facilities, will not unreasonably interfere with your business activities and will be in compliance with your reasonable security procedures. You will provide Splunk with access to the relevant records and facilities. If an audit reveals that you have exceeded the daily peak volume during the period audited, then Splunk will invoice you, and you will promptly pay Splunk any underpaid fees based on Splunk's price list in effect at the time the audit is completed. If the daily peak volume usage exceeds ten percent (10%) of the licensed usage, then you will also pay Splunk's reasonable costs of conducting the audit.\par +\par +PURCHASED SOFTWARE WARRANTY. Splunk warrants that for a period of thirty (30) days after your registration of the Software with Splunk, the Software will substantially achieve any material function described in documentation for the Software published by Splunk. As Splunk's sole liability and your sole remedy for any failure of the Software to conform to this warranty, Splunk will repair or replace (at Splunk's option) your copy of the Software.\par +\par +WARRANTY DISCLAIMER. EXCEPT AS SET FORTH ABOVE, SPLUNK DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, QUIET ENJOYMENT AND WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE. Splunk does not warrant (i) that the Software, developer's API'S or example modules will meet your requirements, (ii) that the Software will operate in the combinations that you may select, (iii) that the Software will serve the purposes intended by you, or (iv) that the operation of the Software will be error free or uninterrupted or that any Software errors will be corrected.\par +\par +LIMITATION OF LIABILITY. SPLUNK'S TOTAL CUMULATIVE LIABILITY TO YOU, FROM ALL CAUSES OF ACTION AND ALL THEORIES OF LIABILITY, WILL BE LIMITED TO AND WILL NOT EXCEED THE AMOUNTS PAID BY YOU TO SPLUNK IN THE TWELVE MONTHS PRIOR TO THE EVENT GIVING RISE TO SUCH LIABILITY. IN NO EVENT WILL SPLUNK BE LIABLE TO YOU FOR ANY SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (INCLUDING LOSS OF USE, DATA, OR PROFITS, BUSINESS INTERRUPTION, OR COSTS OF PROCURING SUBSTITUTE SOFTWARE) ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE USE OR PERFORMANCE OF THE SOFTWARE, WHETHER SUCH LIABILITY ARISES FROM CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, AND WHETHER OR NOT SPLUNK HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE. THE PARTIES HAVE AGREED THAT THESE LIMITATIONS WILL SURVIVE AND APPLY EVEN IF ANY REMEDY IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE. WITHOUT LIMITING THE FOREGOING, SPLUNK WILL HAVE NO LIABILITY OR RESPONSIBILITY FOR ANY BUSINESS INTERRUPTION OR LOSS OF DATA ARISING FROM THE AUTOMATIC TERMINATION OF THE LICENSE RIGHTS GRANTED HEREIN AND ANY ASSOCIATED CESSATION OF THE SOFTWARE FUNCTIONS. BECAUSE SOME STATES OR JURISDICTIONS DO NOT ALLOW LIMITATION OR EXCLUSION OF CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.\par +\par +PURCHASED SOFTWARE INDEMNITY. Splunk will defend, indemnify and hold you harmless from and against any loss, damage, liability or cost (including reasonable attorneys' fees) resulting from any third party claim that the Purchased Software infringes or violates any third party's patent, copyright or trademark rights; provided that you promptly notify Splunk in writing of any and all such claims. In the event of any loss, damage, liability or cost for which Splunk is obligated to indemnify you hereunder, Splunk shall have sole control of the defense and all related settlement negotiations, and you shall reasonably cooperate with Splunk in the defense and/or settlement thereof at Splunk's expense; provided that you may participate in such defense using your own counsel, at your own expense.\par +\par +TERMINATION. You may terminate this Agreement at any time by destroying or returning to Splunk all copies of the Software, including any documentation, in your possession and control, and providing to Splunk a written statement signed by an authorized representative of your company notifying Splunk that you are terminating the Agreement and certifying such destruction or return. Upon thirty days notice, Splunk may terminate this Agreement (and your license rights) upon notice in the event that you breach any provision of this Agreement and have not cured the breach during such notice period. Upon any expiration or termination of this Agreement, the rights and licenses granted hereunder will automatically terminate, and you agree to immediately cease using the Software and to return or destroy all copies of the Software in your possession or control. In the event of termination of this Agreement, Splunk will have no obligation to refund any License Fees, Support Fees, or other fees received from you during the Term. All provisions of this Agreement related to disclaimers of warranties, limitation of liability, remedies, damages, or Splunk's proprietary rights shall survive termination.\par +\par +SEVERABILITY. All rights and remedies, whether conferred hereunder or by any other instrument or law, will be cumulative and may be exercised singularly or concurrently. Failure by either Splunk or You to enforce any term will not be deemed a waiver of future enforcement of that or any other term. The terms and conditions stated herein are declared to be severable. Should any term(s) or condition(s) of this Agreement be held to be invalid or unenforceable the validity, construction and enforceability of the remaining terms and conditions of this Agreement shall not be affected.\par +\par +EXPORT. You agree to comply fully with all relevant export laws and regulations of the United States ("Export Laws") to ensure that the Software is not (i) exported or re-exported directly or indirectly in violation of Export Laws; or (ii) intended to be used for any purposes prohibited by the Export Laws, including but not limited to nuclear, chemical, or biological weapons proliferation.\par +\par +GOVERNMENT RESTRICTED RIGHTS. The Software shall be classified as "commercial computer software" as defined in the applicable provisions of the Federal Acquisition Regulation (the "FAR") and supplements thereto, including the Department of Defense (DoD) FAR Supplement (the "DFARS"). The parties acknowledge that the Software was developed entirely at private expense and that no part of the Software was first produced in the performance of a Government contract. If the Software is supplied for use by DoD, the Software is delivered subject to the terms of this Agreement and in accordance with DFARS 227.7202-1(a) and 227.7202-3(a) (1995), with restricted rights in accordance with DFARS 252.227-7013(c)(1)(ii) (OCT 1988), as applicable. If the Software is supplied for use by a Federal agency other than DoD, the Software is restricted computer software delivered subject to the terms of this Agreement and FAR 12.212(a) (1995); (ii) FAR 52.227-19; or FAR 52.227-14(ALT III), as applicable.\par +\par +PUBLICITY. You agree that Splunk may identify you as a Splunk customer on Splunk websites, client lists, press releases, and/or other marketing. You also agree that Splunk may publish a brief description highlighting your deployment of the Software.\par +\par +GENERAL. This Agreement shall be governed by and construed in accordance with the laws of the State of California, as if performed wholly within the state and without giving effect to the principles of conflict of law. Any legal action or proceeding arising under this Agreement will be brought exclusively in the federal or state courts located in the Northern District of California and the parties hereby consent to personal jurisdiction and venue therein. If any portion hereof is found to be void or unenforceable, the remaining provisions of this Agreement shall remain in full force and effect. Neither party may assign this Agreement, in whole or in part, except in connection with an internal reorganization or a sale of the business with which this Agreement is associated without Splunk's prior written consent, and any attempt to assign this Agreement other than as permitted above will be null and void. This Agreement is intended for the sole and exclusive benefit of the parties and is not intended to benefit any third party. Only the parties to this Agreement may enforce it. This Agreement and any Order Confirmations constitute the complete and exclusive understanding and agreement between the parties regarding their subject matter and supersede all prior or contemporaneous agreements or understandings, written or oral, relating to their subject matter. Any waiver, modification or amendment of any provision of this Agreement will be effective only if in writing and signed by duly authorized representatives of both parties.\par +} + diff --git a/apps/eventid/license-eula.txt b/apps/eventid/license-eula.txt new file mode 100644 index 00000000..694e5878 --- /dev/null +++ b/apps/eventid/license-eula.txt @@ -0,0 +1,52 @@ +SPLUNK SOFTWARE LICENSE AGREEMENT + +THIS SPLUNK SOFTWARE LICENSE AGREEMENT (THE "AGREEMENT") GOVERNS ALL SOFTWARE PROVIDED BY SPLUNK INC. ("SPLUNK") INCLUDING FREE SPLUNK SOFTWARE ("FREE SOFTWARE") AND SOFTWARE PURCHASED THROUGH SPLUNK'S ONLINE STORE OR OTHER CHANNELS ("PURCHASED SOFTWARE"), COLLECTIVELY THE SPLUNK SOFTWARE ("SOFTWARE") AND ANY AND ALL UPDATES, UPGRADES, AND MODIFICATIONS THERETO. CONFIRMATION OF YOUR ORDERS ("ORDER CONFIRMATION") WILL BE DEEMED INCORPORATED INTO AND MADE PART OF THIS AGREEMENT. + +YOU WILL BE REQUIRED TO INDICATE YOUR AGREEMENT TO THESE TERMS AND CONDITIONS IN ORDER TO DOWNLOAD THE SOFTWARE AND REGISTER WITH SPLUNK IN ORDER TO OBTAIN LICENSE KEYS NECESSARY TO COMPLETE THE INSTALLATION PROCESS FOR PURCHASED SOFTWARE. BY CLICKING ON THE "YES" BUTTON, DOWNLOADING OR INSTALLING THE SOFTWARE, OR USING ANY MEDIA THAT CONTAINS THE SOFTWARE, YOU ARE CONSENTING TO BE BOUND BY THIS AGREEMENT. + +IF YOU AGREE TO THESE TERMS ON BEHALF OF A BUSINESS, YOU REPRESENT AND WARRANT THAT YOU HAVE AUTHORITY TO BIND THAT BUSINESS TO THIS AGREEMENT, AND YOUR AGREEMENT TO THESE TERMS WILL BE TREATED AS THE AGREEMENT OF THE BUSINESS. IN THAT EVENT, "YOU" AND "YOUR" REFER HEREIN TO THAT BUSINESS. + +"Splunk Developer API" means the documentation and functionality enabling the creation of extensions to the Software. "Example Modules" means the source code and binary form of examples that use the Splunk Developer API. + +PURCHASED SOFTWARE TERM. Unless earlier terminated, this Agreement will be in effect perpetually for any Purchased Software. "Term" means the period in which the Agreement is in effect. + +PURCHASED SOFTWARE FREE TRIAL. Notwithstanding the foregoing, if the applicable Order Confirmation is limited to a free trial license, then the Term will be limited to the free trial period specified in the Order Confirmation, this Agreement and any license rights granted hereunder will automatically terminate at the end of the free trial period, and there will be no Renewal Term. Any license keys provided for a free trial will automatically expire and may cause the Software to become non-operational at the end of the free trial period. Provisions in this Agreement regarding License Fees, Maintenance and Support, and Warranty will not apply to free trials. + +PURCHASED SOFTWARE LICENSE. Subject to your compliance with the terms and conditions of this Agreement, including your payment of the license fees set forth in each Order Confirmation (the "License Fees"), Splunk grants you a nonexclusive, nontransferable, revocable, limited license during the Term to use the Software for which you have paid the applicable License Fees as set forth in your Order Confirmation(s), only for your internal business purposes (which shall include use by consultants, accountants, auditors and attorneys hired to perform services for you) and only subject to the following conditions: you may use each Splunk Server with an Enterprise license to index no more than the peak daily volume of uncompressed data for which you have paid the applicable License Fees as set forth in your Order Confirmation (the "Maximum Peak Daily Volume"). The Software will be configured to display warnings and/or cease indexing data when the Maximum Peak Daily Volume is reached. + +FREE SOFTWARE LICENSE. Subject to the terms and conditions of this Agreement, Splunk grants to You a non-exclusive, worldwide, fully-paid up copyright license to use the Free Splunk Software in binary form only and only subject to the following conditions: (i) to index no more than 500MB of peak daily volume of uncompressed data (the 'Maximum Peak Daily Volume') and only for your internal business purposes (which shall include use by consultants, accountants, auditors and attorneys hired to perform services for you). The Software will be configured to display warnings, reduce available functionality, and/or cease indexing data when the Maximum Peak Daily Volume is reached. + +EXTENSION LICENSE. Splunk further grants to You a non-exclusive, worldwide, fully-paid up copyright license to use the Splunk Developer API and Example Modules included with the Software solely for the purpose of developing extensions to access the Splunk API or Example Modules for Your use in conjunction with the Software (collectively, "Your Extensions"). You agree to assume full responsibility for the performance of Your Extensions, and shall indemnify, hold harmless, and defend Splunk (including all of its officers, employees, directors, subsidiaries, representatives, affiliates and agents) and Splunk's suppliers from and against any claims or lawsuits, including attorney's fees and expenses, that arise or result from Your Extensions pursuant to this Agreement. You retain title to and copyright for Your Extensions, subject to Splunk's title to and copyright for the Software, the Splunk Developer API, and the Example Modules as specified in Ownership and Copyrights, below. This Agreement does not grant you any distribution rights. If you want to distribute or provide to any third parties Your Extensions, you must first register as a Splunk application developer and agree to the Splunk Developer Agreement at http://www.splunk.com/goto/devagreement. You will not remove or change any Splunk copyright notices or branding included in the Splunk Software or required by Splunk's Identity Guidelines as set forth at http://www.splunk.com/goto/splunkpowered, Splunk Developer APIs, or Example Modules, and will include such notices and branding in each copy of Your Extensions, the Splunk Software, the Splunk Developer APIs, and the Examples Modules that you make or distribute. + +PURCHASED SOFTWARE RESTRICTIONS. You agree not to (i) use the Software except as expressly authorized in this Agreement and your Order Confirmation; (ii) copy the Software (except as required to run the Software and for reasonable backup purposes); (iii) modify, adapt, or create derivative works of the Software; (iv) rent, lease, loan, resell, transfer, sublicense (including but not limited to offering any of the functionality of the Software on a service provider, hosted or time sharing basis) or distribute the Software to any third party; (v) decompile, disassemble or reverse-engineer the Software or otherwise attempt to derive the Software source code; (vi) disclose to any third party the results of any benchmark tests or other evaluation of the Software, or (vii) authorize any third parties to do any of the above. + +FREE SOFTWARE RESTRICTIONS. You shall not (i) decompile, disassemble or reverse engineer the Free Software without the express written authorization of Splunk; (ii) modify, adapt, or create derivative works of the Free Software; (iii) rent, lease, loan, or resell the Free Software, the Splunk Developer API, Example Modules, or Your Extensions (including but not limited to offering the functionality of the Free Software on an applications service provider or time sharing basis), except as expressly permitted in the Splunkbase Application Developer Agreement; (iv) decompile, disassemble or reverse-engineer the Software or otherwise attempt to derive the Software source code; (v) disclose to any third party the results of any benchmark tests or other evaluation of the Software, or (vi) authorize any third parties to do any of the above. + +OWNERSHIP. Splunk and/or its licensors own all worldwide right, title and interest in and to the Software, including all worldwide intellectual property rights therein. You will not delete or in any manner alter the copyright, trademark, and other proprietary rights notices appearing in or on the Software as provided. All right, title, and interest in and to all copies the Splunk Developer API, and the Example Modules remains with Splunk and/or its licensors. The Software, Splunk Developer API, and Example Modules are copyrighted and protected by the laws of the United States and other countries, and international treaty provisions. You may not remove any copyright notices from the Software, the Splunk Developer API, or the Example Modules. + +PURCHASED SOFTWARE LICENSE AND FEES. In order to access and use the Software, you are required to pay to Splunk the License Fees in accordance with your Order Confirmation. The License Fees will be due and payable in accordance with the terms set forth in your Order Confirmation. Any failure to pay the License Fees in accordance with an Order Confirmation will result in automatic revocation and termination of this Agreement and all rights and licenses granted hereunder. All License Fees are non-refundable once paid. + +MAINTENANCE AND SUPPORT. Subject to your payment of the applicable annual maintenance and support fees set forth in your Order Confirmation (the "Support Fees"), Splunk will provide the level of support for the Purchased Software identified in your Order Confirmation in accordance with the support descriptions set forth on Splunk's website at www.splunk.com. Splunk is not obligated to support, update or upgrade the Free Software. + +PURCHASED SOFTWARE VERIFICATION AND AUDIT. At Splunk's written request, you will furnish Splunk with a certification signed by an officer of your company verifying that the Software is being used in accordance with the terms and conditions of this Agreement and the applicable Order Confirmations. Upon at least ten (10) days prior written notice, Splunk may audit your use of the Software to ensure that you are in compliance with the terms of this Agreement and the applicable Orders. Any such audit will be conducted during regular business hours at your facilities, will not unreasonably interfere with your business activities and will be in compliance with your reasonable security procedures. You will provide Splunk with access to the relevant records and facilities. If an audit reveals that you have exceeded the daily peak volume during the period audited, then Splunk will invoice you, and you will promptly pay Splunk any underpaid fees based on Splunk's price list in effect at the time the audit is completed. If the daily peak volume usage exceeds ten percent (10%) of the licensed usage, then you will also pay Splunk's reasonable costs of conducting the audit. + +PURCHASED SOFTWARE WARRANTY. Splunk warrants that for a period of thirty (30) days after your registration of the Software with Splunk, the Software will substantially achieve any material function described in documentation for the Software published by Splunk. As Splunk's sole liability and your sole remedy for any failure of the Software to conform to this warranty, Splunk will repair or replace (at Splunk's option) your copy of the Software. + +WARRANTY DISCLAIMER. EXCEPT AS SET FORTH ABOVE, SPLUNK DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, QUIET ENJOYMENT AND WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE. Splunk does not warrant (i) that the Software, developer's API'S or example modules will meet your requirements, (ii) that the Software will operate in the combinations that you may select, (iii) that the Software will serve the purposes intended by you, or (iv) that the operation of the Software will be error free or uninterrupted or that any Software errors will be corrected. + +LIMITATION OF LIABILITY. SPLUNK'S TOTAL CUMULATIVE LIABILITY TO YOU, FROM ALL CAUSES OF ACTION AND ALL THEORIES OF LIABILITY, WILL BE LIMITED TO AND WILL NOT EXCEED THE AMOUNTS PAID BY YOU TO SPLUNK IN THE TWELVE MONTHS PRIOR TO THE EVENT GIVING RISE TO SUCH LIABILITY. IN NO EVENT WILL SPLUNK BE LIABLE TO YOU FOR ANY SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (INCLUDING LOSS OF USE, DATA, OR PROFITS, BUSINESS INTERRUPTION, OR COSTS OF PROCURING SUBSTITUTE SOFTWARE) ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT OR THE USE OR PERFORMANCE OF THE SOFTWARE, WHETHER SUCH LIABILITY ARISES FROM CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, AND WHETHER OR NOT SPLUNK HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE. THE PARTIES HAVE AGREED THAT THESE LIMITATIONS WILL SURVIVE AND APPLY EVEN IF ANY REMEDY IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE. WITHOUT LIMITING THE FOREGOING, SPLUNK WILL HAVE NO LIABILITY OR RESPONSIBILITY FOR ANY BUSINESS INTERRUPTION OR LOSS OF DATA ARISING FROM THE AUTOMATIC TERMINATION OF THE LICENSE RIGHTS GRANTED HEREIN AND ANY ASSOCIATED CESSATION OF THE SOFTWARE FUNCTIONS. BECAUSE SOME STATES OR JURISDICTIONS DO NOT ALLOW LIMITATION OR EXCLUSION OF CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU. + +PURCHASED SOFTWARE INDEMNITY. Splunk will defend, indemnify and hold you harmless from and against any loss, damage, liability or cost (including reasonable attorneys' fees) resulting from any third party claim that the Purchased Software infringes or violates any third party's patent, copyright or trademark rights; provided that you promptly notify Splunk in writing of any and all such claims. In the event of any loss, damage, liability or cost for which Splunk is obligated to indemnify you hereunder, Splunk shall have sole control of the defense and all related settlement negotiations, and you shall reasonably cooperate with Splunk in the defense and/or settlement thereof at Splunk's expense; provided that you may participate in such defense using your own counsel, at your own expense. + +TERMINATION. You may terminate this Agreement at any time by destroying or returning to Splunk all copies of the Software, including any documentation, in your possession and control, and providing to Splunk a written statement signed by an authorized representative of your company notifying Splunk that you are terminating the Agreement and certifying such destruction or return. Upon thirty days notice, Splunk may terminate this Agreement (and your license rights) upon notice in the event that you breach any provision of this Agreement and have not cured the breach during such notice period. Upon any expiration or termination of this Agreement, the rights and licenses granted hereunder will automatically terminate, and you agree to immediately cease using the Software and to return or destroy all copies of the Software in your possession or control. In the event of termination of this Agreement, Splunk will have no obligation to refund any License Fees, Support Fees, or other fees received from you during the Term. All provisions of this Agreement related to disclaimers of warranties, limitation of liability, remedies, damages, or Splunk's proprietary rights shall survive termination. + +SEVERABILITY. All rights and remedies, whether conferred hereunder or by any other instrument or law, will be cumulative and may be exercised singularly or concurrently. Failure by either Splunk or You to enforce any term will not be deemed a waiver of future enforcement of that or any other term. The terms and conditions stated herein are declared to be severable. Should any term(s) or condition(s) of this Agreement be held to be invalid or unenforceable the validity, construction and enforceability of the remaining terms and conditions of this Agreement shall not be affected. + +EXPORT. You agree to comply fully with all relevant export laws and regulations of the United States ("Export Laws") to ensure that the Software is not (i) exported or re-exported directly or indirectly in violation of Export Laws; or (ii) intended to be used for any purposes prohibited by the Export Laws, including but not limited to nuclear, chemical, or biological weapons proliferation. + +GOVERNMENT RESTRICTED RIGHTS. The Software shall be classified as "commercial computer software" as defined in the applicable provisions of the Federal Acquisition Regulation (the "FAR") and supplements thereto, including the Department of Defense (DoD) FAR Supplement (the "DFARS"). The parties acknowledge that the Software was developed entirely at private expense and that no part of the Software was first produced in the performance of a Government contract. If the Software is supplied for use by DoD, the Software is delivered subject to the terms of this Agreement and in accordance with DFARS 227.7202-1(a) and 227.7202-3(a) (1995), with restricted rights in accordance with DFARS 252.227-7013(c)(1)(ii) (OCT 1988), as applicable. If the Software is supplied for use by a Federal agency other than DoD, the Software is restricted computer software delivered subject to the terms of this Agreement and FAR 12.212(a) (1995); (ii) FAR 52.227-19; or FAR 52.227-14(ALT III), as applicable. + +PUBLICITY. You agree that Splunk may identify you as a Splunk customer on Splunk websites, client lists, press releases, and/or other marketing. You also agree that Splunk may publish a brief description highlighting your deployment of the Software. + +GENERAL. This Agreement shall be governed by and construed in accordance with the laws of the State of California, as if performed wholly within the state and without giving effect to the principles of conflict of law. Any legal action or proceeding arising under this Agreement will be brought exclusively in the federal or state courts located in the Northern District of California and the parties hereby consent to personal jurisdiction and venue therein. If any portion hereof is found to be void or unenforceable, the remaining provisions of this Agreement shall remain in full force and effect. Neither party may assign this Agreement, in whole or in part, except in connection with an internal reorganization or a sale of the business with which this Agreement is associated without Splunk's prior written consent, and any attempt to assign this Agreement other than as permitted above will be null and void. This Agreement is intended for the sole and exclusive benefit of the parties and is not intended to benefit any third party. Only the parties to this Agreement may enforce it. This Agreement and any Order Confirmations constitute the complete and exclusive understanding and agreement between the parties regarding their subject matter and supersede all prior or contemporaneous agreements or understandings, written or oral, relating to their subject matter. Any waiver, modification or amendment of any provision of this Agreement will be effective only if in writing and signed by duly authorized representatives of both parties. + diff --git a/apps/eventid/lookups/eventid_interesting_events.csv b/apps/eventid/lookups/eventid_interesting_events.csv new file mode 100644 index 00000000..154a5207 --- /dev/null +++ b/apps/eventid/lookups/eventid_interesting_events.csv @@ -0,0 +1,22 @@ +event_id,source,description +104,Microsoft-Windows-Eventlog,Attackers tend to clear logs in order to hide previous activity. +104,Eventlog,Attackers tend to clear logs in order to hide previous activity. +517,Security,Attackers tend to clear logs in order to hide previous activity. +1000,Application Error,Critical application error +1001,Microsoft-Windows-WER-SystemErrorReporting,Blue Screen of Death +1002,Application Hang,Application hang +1076,USER32,An admin provided a reason for an unexpected restart +1102,Eventlog,Attackers tend to clear logs in order to hide previous activity. +2004,Microsoft-Windows-Windows Firewall with Advanced Security,Firewall rule added +2006,Microsoft-Windows-Windows Firewall with Advanced Security,Firewall rule deleted +2033,Microsoft-Windows-Windows Firewall with Advanced Security,Firewall rule deleted +4608,Microsoft Windows security auditing,The computer has been restarted - not an usual event. +4625,Microsoft Windows security auditing,A user failed to logon +4663,Microsoft-Windows-Security-Auditing,An audited object has been accessed. +4719,Microsoft-Windows-Security-Auditing,System audit policy was changed +4728,Microsoft-Windows-Security-Auditing,User Added to Privileged Group +4732,Microsoft-Windows-Security-Auditing,User Added to Privileged Group +4735,Microsoft-Windows-Security-Auditing,Security-Enabled Group Modification +4740,Microsoft-Windows-Security-Auditing,Account lockout +4756,Microsoft-Windows-Security-Auditing,User Added to Privileged Group +7045,Service Control Manager,Installation of new services are not typical events. diff --git a/apps/eventid/lookups/eventid_interesting_processes.csv b/apps/eventid/lookups/eventid_interesting_processes.csv new file mode 100644 index 00000000..123f2868 --- /dev/null +++ b/apps/eventid/lookups/eventid_interesting_processes.csv @@ -0,0 +1,72 @@ +process,Category,Process_Details +arp.exe,Target Discovery,Obtains information about hosts on the local broadcast domain +at.exe,Command Execution,Executes a task at the specified time and it may be used to secretly place an application or script without being recognized by the user in advance and then execute it at the desired time. +bcdedit.exe,Privilege Escalation,Tool for editing the boot configuration and it may be used to escalate privileges +bcp.exe,Data extraction,Bulk copy of data from database. It may be used to exfiltrate data. +chcp.exe,Malware,"Displays the number of the active console code page, or changes the console's active console code page." +cmd.exe,Command Execution,Can be used to execute a large number of commands +cscript.exe,Command Execution,Can be used to execute a large number of scripts +csvde.exe,Acquisition of Account Information,Outputs account information on the Active Directory in the CSV format and it can be used to extract information on an existing account and select users and clients available as attack targets. +dsquery.exe,Acquisition of Account Information,"Obtains information, such as users and groups, from a directory service and it can be used to extract information on an existing account and select users and clients available as attack targets." +Find-GPOPasswords.ps1,Password Hash Acquisition,Acquires any password descriptions in a group policy file and may attempt to infiltrate other hosts using acquired passwords (by executing the tool on Active Directory). +GSECDUMP.EXE,Password Hash Acquisition,Extracts hash from SAM/AD or logon sessions and use it to log on to other hosts using acquired hash information. +icacls.exe,File Sharing,Changes the file access rights and it can be used to change the rights to read a file that cannot be read by the used account. It is also used to capture rights so that the content of a file created by the attacker will not be viewable +ipconfig.exe,Target Discovery,Displays or changes IP stack information +ldifde.exe,Acquisition of Account Information,Outputs account information on the Active Directory in the LDIF format and it can be used to extract information on an existing account and select users and clients available as attack targets. +mailpv.exe,Password Hash Acquisition,Extracts account information saved in the mail client settings on the machine +mimikatz.exe,Password Hash Acquisition,Steals recorded authentication information and it can be used to escalate the privileges to the domain Administrator privileges. +ms14-068.exe,Escalation to SYSTEM Privileges,Changes the privileges of the domain user to those of another user +nbtstat.exe,Target Discovery,Allows a refresh of the NetBIOS name cache and the names registered with Windows Internet Name Service (WINS). +nc.exe,Target Discovery,"Multpurpose tool, can be used for probing ports" +net.exe,Adding or Deleting a Local User/Group,Adds a user account in a client or the domain or creates a network share and it can be used to create accounts or additional sessions in the machine the attacker has infected or to communicate with other hosts. +net1.exe,Adding or Deleting a Local User/Group,Adds a user account in a client or the domain or creates a network share and it can be used to create accounts or additional sessions in the machine the attacker has infected or to communicate with other hosts. +netcat.exe,Target Discovery,"Multpurpose tool, can be used for probing ports" +netsh,Command Execution,"Allows to, either locally or remotely, display or modify the network configuration of a computer that is currently running. " +netstat.exe,Target Discovery,"Displays active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, IPv4 statistics " +nmap,Target Discovery,Port scanner +nslookup.exe,Target Discovery,Performs a DNS lookup +ntdsutil.exe,Capturing Active Directory Database,"A command to maintain Active Directory databases and it can be used to extract NTDS.DIT, a database for NTDS, and other tools are used to analyze passwords (executed in Active Directory)." +OSQL.exe,Data extraction,"Allows execution of Transact-SQL statements, system procedures, and script files. Can be used to attack a database or exfiltrate information." +powercat.ps1,Malware,Part of PSAttack hacking tools +powershell.exe,Command Execution,Allows remote command execution and it may be used to change settings to enable the Domain Controller and other hosts on the network to perform operations requiring administrator rights +procdump.exe,Command Execution,Utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike +psexec.exe,Command Execution,Executes a process on a remote system and it may be used to remotely execute a command on client and servers in a domain. +psexecsvc.exe,Command Execution,Tool used for remotely executing processes on other systems +psLoggedOn.exe,Target Discovery,Displays both the locally logged on users and users logged on via resources for either the local computer +PwDump7.exe,Password Hash Acquisition,Displays a list of password hashes in the system and it may be used to perform logon authentication on other hosts using the acquired hash information. +PWDumpX.exe,Password Hash Acquisition,Acquires a password hash from a remote host and use it to perform attacks such as pass-the-hash. +qprocess.exe,Privilege Escalation,Query Process Utility - It can be used to start an elevated subprocess +QuarksPwDump.exe,Password Hash Acquisition,Acquires the NTLM hash of a local domain account and cached domain password and it may be used to perform logon authentication on other hosts using the acquired hash information. +query.exe,Target Discovery,Query User Sessions in Windows +rar.exe,Command Execution,"Used by many attackers to deploy tools, exfiltrate information" +rdpv.exe,Password Hash Acquisition,Extracts account information saved in the RDP settings on the machine and use it to log in to other hosts with such passwords. +reg.exe,Command Execution,"Adds, changes, and displays registry subkey information and values in registry entries." +route.exe,Target Discovery,Display or changes routing information +runas.exe,Command Execution,Runs command using a different account +rundll32,Command Execution,Tool responsible for running DLLs and placing its libraries in the memory +sc.exe,Command Execution,Retrieves and sets control information about services. +schtasks.exe,Command Execution,"Enables an administrator to create, delete, query, change, run, and end scheduled tasks on a local or remote computer. Can be used by an attacker in many situations." +sdbinst.exe,Privilege Escalation,SDB UAC Bypass - used to execute an application that is not normally executed by pretending to execute a typical application. +sdelete.exe,Deleting Evidence,Deletes a file after overwriting it several times and it can be used to delete a file created in the course of an attack to make it impossible to be recovered. +sethc.exe,Privilege Escalation,Sticky Keys utility +sqlcmd.exe,Command Execution,Manage SQL server from command line +ssh.exe,Command Execution,Opens a secure shell on a remote host +sysprep.exe,Privilege Escalation,"Prepares an installation of Windows for duplication, auditing, and customer delivery." +systeminfo.exe,Target Discovery,"Command-line utility that displays information about your Windows version, BIOS, processor, memory, network configuration" +tasklist.exe,Target Discovery,Displays running processes +timestomp.exe,Deleting Evidence,Changes the file timestamp and it can be used to conceal the access to the file by restoring the timestamp. +tracert.exe,Target Discovery,Traceroute tool. It can be used to discover information about the network +vssadmin.exe,Capturing Active Directory Database,"Creates Volume Shadow Copy and extracts NTDS.DIT and it can be used to extract NTDS.DIT, a database for NTDS, so that the password can be analysed using other tools." +wce.exe,Password Hash Acquisition,Acquires password hash information in the memory of a logged in host +wceaux.dll,Privilege Escalation,Executes a command with higher privileges using the hash of the acquired password +WebBrowserPassView.exe,Password Hash Acquisition,Extracts user names and passwords saved in the web browser of a machine +wevtutil.exe,Deleting Evidence,Deletes Windows event logs and it can be used to delete the evidence of an attack. +whoami.exe,Target Discovery,Displays information about the current user +winrar.exe,Command Execution,"Used by many attackers to deploy tools, exfiltrate information" +winrs.exe,Command Execution,Executes a command on a remote hosts +WMIC.exe,Command Execution,A tool used for Windows system management and it may be used to acquire information on the remote system or to execute a command with WMI. +wmic.exe,Command Execution,Windows Management Instrumentation Command-line +wmiexec.vbs,Command Execution,A tool used for Windows system management that may execute a script for other hosts. +wscript.exe,Command Execution,Can be used to execute a large number of scripts +wsmprovhost.exe,Privilege Escalation,WinRM Remote Powershell - Can be used to elevate privileges +wusa.exe,Privilege Escalation,Windows Update Standalone Installer - Can be used to elevate privileges diff --git a/apps/eventid/lookups/xml_event_types.csv b/apps/eventid/lookups/xml_event_types.csv new file mode 100644 index 00000000..0c96e79a --- /dev/null +++ b/apps/eventid/lookups/xml_event_types.csv @@ -0,0 +1,6 @@ +xml_type,event_type +0,Audit Success +1,Audit Failure +2,Error +3,Warning +4,Information \ No newline at end of file diff --git a/apps/eventid/static/appIcon.png b/apps/eventid/static/appIcon.png new file mode 100644 index 00000000..4d0acb37 Binary files /dev/null and b/apps/eventid/static/appIcon.png differ diff --git a/apps/eventid/static/appIconAlt.png b/apps/eventid/static/appIconAlt.png new file mode 100644 index 00000000..3fd665fc Binary files /dev/null and b/apps/eventid/static/appIconAlt.png differ diff --git a/apps/eventid/static/appIconAlt_2x.png b/apps/eventid/static/appIconAlt_2x.png new file mode 100644 index 00000000..220469ed Binary files /dev/null and b/apps/eventid/static/appIconAlt_2x.png differ diff --git a/apps/eventid/static/appIcon_2x.png b/apps/eventid/static/appIcon_2x.png new file mode 100644 index 00000000..aa831f87 Binary files /dev/null and b/apps/eventid/static/appIcon_2x.png differ