In this lesson,
we're going to talk about dashboards.
Now, dashboards are a graphical display
of information across multiple different systems,
and generally we're going to use a dashboard inside
of our security operations center as part of a single pane
of glass architecture.
Now, a single pane of glass essentially means I'm going to have
one screen in front of me as an analyst,
and I can access everything across the organization
from that one panel.
And when I'm looking at that one panel, I need
to be able have a dashboard so I can see exactly what's
going on of all of the different systems
across the network and across the world.
For example, one of the most popular tools to create one
of these interactive style dashboards is
a tool known as Splunk.
Splunk is a big data platform that allows the ingestion
of all sorts of different kinds of data,
including security data, incident response data,
and other data like that.
When we have a tool like Splunk,
it can collect data from your firewalls, your applications,
your endpoints, your operating systems,
your intrusion detection systems,
your intrusion prevention systems, your antivirus software,
your networks, and all of this data
can get rolled up into this big data platform.
And then creating a dashboard will allow you
to see the trends over time,
and then you can take actions based on those trends.
For example, if we take a look at a sample dashboard
from Splunk, you can see here
that this shows my basic security posture of the network.
In this case, we can see
that there are access notables going down.
It's actually three less than it was previously.
We can see the endpoint notables going up by 22, bringing us
to a total count of 2000.
And that's red because it's something bad
and we want to look at, we also see network notables going
down, which means our network is getting more secure
and we see identity notables going down,
which tells us we're actually doing a better job
of protecting the privacy of our organization.
We also have things like infections from our antivirus,
and you can see this went up by one,
so this was a red or negative trend.
And then we also have our threat notables going up by 60,
which means there were 60 more attacks this week
than there was last week.
Additionally, you can look down at different graphs
and you can see things like, how is the status
of your vulnerability scanning?
And then if we move down the page,
we can see two different graphs.
On the left side, we have our notable events occurrence
by urgency, and you'll notice
that these are basically the same urgency
that we talk about in vulnerability scanning.
We have unknown, informational, low, medium, high,
and critical, and our goal is to get the criticals down
as low as possible, and we can allow things like
informational or lows to be a little bit higher.
In this network, we can see that the urgency
of critical is actually only 10 things,
but if we go into our mediums, highs
or criticals, we're looking somewhere
between 800 and 2000 in terms of the amount
of notable events for each of those criticality levels.
So as an executive, I would be looking at this
and going, "Okay, we have a very large network
and only 10 criticals, which is great,
but we also need to look at those 10 criticals
and see how we can get them down to zero."
The other thing we have is on the right hand side,
we can see the trends over time.
Here, we can see that over the last 24 hours we had,
on average the threat was around 100 counts.
There were some things that were higher and some were lower.
As you can see in the last hour or so,
at the time of this dashboard, we see a spike
of red going up, which is the endpoint area,
which is showing that we went from the hundred,
which was kind of our baseline up to a thousand.
So this sounds like we're actually under attack in terms
of our endpoints, and we'd want to figure out why
that is and what's going on there.
Now with all of these, because you're dealing
with a dashboard, you can actually click on it
and drill down into it.
When you look at something in the bottom right, for example,
we can see the top notable event occurrence by host,
and we can see that the top host there,
which is at IP address, 10.1.21.153
has quite a few spikes there,
which means we actually had seven
different counts that were occurring.
So we want to go and look at that machine.
If I clicked on that, it would actually drill into that
and show me all the different data points we've collected
from all of the different systems so we can analyze those.
Now, we're not going to cover those in this particular lesson
because all those other data points are going to be specific
to the dashboard you're using.
But in this lesson, I just wanted to show you
how you can read some of these graphs
and get an idea of, are things going better
for you or are things going worse?
And how you can use a dashboard to drill down
and use that as your central single pane of glass
as your starting point, as you begin your investigation,
as you're trying to respond to an incident response.