Make sure you properly install and configure ES Choreographer!
Please see the "installation" tab. If you're on Splunkbase classic, make sure you go to the "new" splunkbase.
If you're curious to see the peer review / change tracking in action:
- go to ES's content management
- modify a correlation search (enable/disable, change the schedule and/or the SPL, etc)
- go back to the status dashboard in ES choreographer and set it for peer review by clicking the corresponding button
- click "quick correlation data refresh" - your search should appear as pending review
- click the "pending" - the diff should show your changes
From there, test the task management system:
- click the TODO/Done navigation button to go to the TODO page for that correlation.
- use the form to add a TODO
- navigate back to the status dashboard and refresh it. Maybe set it for TODOs. Your TODO should appear in the list.
Navigate to the Best Practices dashboard:
- click on a line in the main table
- scroll down and click on the question marks ? to slide out more documentation about what the dashboard is doing.
The morning checks checks dashboard is there as a stub for your own checks.
Please check out the documentation page on my blog.
This app was introduced and demonstrated in SEC1441A at .conf21 "How We Maintain Our Correlations in Splunk Enterprise Security at Thales UK": pdf/mp4
Tweaked the IR-linked TODO dashboard and its corresponding workflow action to make cloud's appinspect happy.
ES Choreographer 1.5.1:
Status dashboard now shows drilldowns to "open in search" by default.
Best Practices dashboard: clicking on status now opens ES content management page, just like the Status dashboard.
Health dashboard is now more interactive so that the diffs shown are less overwhelming.
Bug fix: bulk peer review dashboard not loading properly
Bug fix: notable counts not reported properly if using non-standard is_redteam field (i.e. if ESC_CS_is_redteam_fieldname was customised)
All dashboards accessible from the menu
Multiselect filter based on app for Status, Best Practices and Bulk Peer Review dashboards.
Bulk Peer Review: no limits to number of fields to focus on
Performance issue fix: Status and Bulk Peer Review dashboards can now handle thousands of correlation without issue
New (since 1.4.1) Business of Schedules dashboards to help spread cron schedules
Best Practices dashboard: Now shows correlations without notable, risk or email actions + various Best Practices are now configurable: identities, prefix, morning checks, redteam...
Now tracking and showing actions, mitre annotation, risk_message, threat_object and threat_object_type
Compatible with ES 7.2: will track and show up to 3 different drilldown searches
Fixed issues with CSS not working in Peer Review and TODO dashboards
Status dashboard has new drilldowns to open in search, go to toggle status or go to ID card
Plus various tidy up to make it easier for me to do future dev work
Menu now defaults to Status dashboard
IR Fields dashboard removed - ES IR settings page is actually user friendly enough now
Workflow Action dashboard removed - now linking to the same but in ConfManager (if installed, not essential)
New Health dashboard to check dependencies and integrity (especially for upgrades!)
Changes dashboard is now more interactive.
Comment history dashboard now drills down to IR for IR-linked TODOs as other dashboards do.
Status dashboard links and drilldowns improved.
Many changes to the Best Practices dashboard:
- Navigation in the dashboard: can click on a table cell in the main table and be taken straight to where the BP is detailed, + "back to top" links.
- Each BP now has an "advice" specifying what action is required to fix it, making it much easier to interpret the details tables.
- Leaver best practice removed
- New RBA-related best practices added
- Reports when a search is scheduled on a busy time slot (comes with its own dashboard + advice on the next free slot)
From version 1.1.0 to 1.3.0:
* now tracks who changes correlations:
- Status dashboard in peer review mode shows change author, what fields were changed and when
- Peer Review dashboard shows change author and allows to assign the correlation back to them
- new Changes dashboard shows which correlations have changed over an arbitrary period of time
* new "open in search" button on all dashboards, useful for peer reviews
* ability to rename a correlation search and keep its TODO and review history
* now gets mitre attack from annotations rather than analytic stories. Warning: relies on mitre_enrichment.csv from ES Content Updates
* Bulk Peer Review got more powerful
* Fixed issues:
- fixed bug where Status & Best Practices dashboards didn't show correlations that did not raise risks, notables nor emails
- now copes with correlations raising multiple risk scores
- Cosmetic improvements and minor bug fixes and performance improvements
Thanks to the lovely people at Aflac for their feedback :)
First version on splunkbase. Compared to bitbucket version:
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.