legal contact rss
 

This is the definition of a SIEM sample from real life.

Use all macro and search definition and adjust the mentioned sourcetype to your needs.

 

<dashboard>
  <label>SIEM</label>
  <row>
    <panel>
      <table>
        <searchName>Critical EXTERNAL systems</searchName>
        <title>Critical EXTERNAL systems</title>
        <option name="count">20</option>
        <option name="displayRowNumbers">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <searchName>Main</searchName>
        <title>Severity over dept</title>
        <option name="charting.axisTitleX.text">Week</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.layout.splitSeries">false</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.primaryAxisTitle.text"/>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <searchName>Authentication Failures</searchName>
        <title>Authentication Failures</title>
        <option name="count">10</option>
        <option name="dataOverlayMode">highlow</option>
        <option name="displayRowNumbers">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <searchName>Host that have VULNs, IPS and Malware</searchName>
        <title>Host that have VULNs, IPS and Malware</title>
      </event>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <searchName>Most patchable servers</searchName>
        <title>Most patchable servers</title>
      </table>
    </panel>
    <panel>
      <table>
        <searchName>Unsolved Malware events</searchName>
        <title>Unsolved Malware events</title>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <searchName>Hosts missing in asset database</searchName>
        <title>Hosts missing in asset database</title>
      </table>
    </panel>
    <panel>
      <table>
        <searchName>Authentication Errors while scanning</searchName>
        <title>Authentication Errors while scanning</title>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <searchName>New vulns by time</searchName>
        <title>New vulns being added to Qualys by time</title>
        <option name="charting.chart">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.layout.splitSeries">false</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.primaryAxisTitle.text">Date</option>
        <option name="charting.secondaryAxisTitle.text">Adj. priority</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <searchName>Reduce overall risk just by patching</searchName>
        <title>Reduce overall risk just by patching</title>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <searchName>Risc reduce by patching servers</searchName>
        <title>Risc reduce by patching servers</title>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <searchName>New vulns found the last 24h</searchName>
        <title>New vulns found the last 24h</title>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <searchName>Non patchable EXTERNAL</searchName>
        <title>Non patchable EXTERNAL</title>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <searchName>Unknown owner by dept</searchName>
        <title>Unknown owner by dept</title>
        <option name="charting.chart">bar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <searchName>BOT Net hits the last 24 hours</searchName>
        <title>BOT Net hits the last 24 hours</title>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <searchName>Torrent findings</searchName>
        <title>Torrent findings</title>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <searchName>NO AV installed</searchName>
        <title>NO AV installed</title>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Time since last data from IDS system</title>
        <searchString>sourcetype=snort | eval right_now = now() | eval time_diff = right_now - _time | eval hours = round(time_diff/3600) | where hours &gt;= 24 | eval alert = "Hours since logs last seen - " .hours  | dedup host | table host_nt_host alert hours| sort -hours</searchString>
        <earliestTime>-7d@h</earliestTime>
        <latestTime>now</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>IDS not sending data the past week</title>
        <searchString>sourcetype=company:utm:snort | fillnull value=Unknown | stats latest(_time) As _time by host | where _time&gt;(now()-3600)</searchString>
        <earliestTime>-7d</earliestTime>
        <latestTime>now</latestTime>
      </table>
    </panel>
  </row>
</dashboard>