App Dependencies:
Common Information Model App (CIM) https://splunkbase.splunk.com/app/1621/
1 Authentication
2 Change
3 Endpoint
4 Intrusion Detection
5 Malware
6 Network Sessions
7 Network Traffic
8 Web
Active Directory
Edge Firewalls
Windows Event Logs
Windows Update Logs
Windows Host Mon (OS Stanza)
Anti Virus Logs
VPN Logs
This app can be installed on a Search Head for on-premise Splunk Enterprise customers. For customers using Splunk Cloud, install this app on your search head for victoria experience customers or both your IDM and SH for classic customers.
Install the app. For Splunk Cloud, refer to Install apps in your Splunk Cloud deployment. For customer-managed deployments, refer to the standard methods for Splunk Add-on installs as documented for a Single Server Install or a Distributed Environment Install.
By default the app comes with a pre-configured and disabled input named nhs_cyberalerts, that will fetch cyber alerts daily via REST API and store them in the default index. This input needs to be enabled via the UI.
It is best practice to place your cyber alerts into another index other than the default main index, please make sure you update the macro 'default_index' with definitions such as index=<YOUR_INDEX>
Once installed, from your Splunk instance Web Interface, select the app DSPT Compliance and navigate through the dashboards to verify content.
The app aims to assist in DSPT assertions where IT staff are asked to regularly review certain activity types or provide evidence against assertions. Where a monitoring requirement is required the dashboards found within the 'Audit" drop-down can be used. Where Evidence is required, reports can be found to facilitate the capture of the required information.
There are no known issues at this time.
Useful SPL searches to:
Verify Cyber Alerts indexing index=_internal nhs_cyberalerts.py
Verify the index has been populated with Cyber Alerts index=main
Please replace main with the index specified in the configuration and make sure the time range is set on All time
No special instructions for upgrading this app to a newer version.
While this app is not formally supported, the developer can be reached at kpyart@splunk.com. Responses are made on a best-effort basis. Feedback is always welcome and appreciated!
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.