Tripwire Enterprise App for Splunk Enterprise
Sampling of Reports, Dashboards, and Workflows in the Tripwire Enterprise App for Splunk Enterprise
Assets
Asset Inventory: Easily track and manage your systems by filtering data sources, tags, versions, and more. See system health, licensing, and agent versions through clear visualizations and a comprehensive asset table for fast and informed decisions.
Compliance
SCM - Security Configuration Management: View a snapshot of security configuration tests across your systems and monitor the health of your nodes by showing which have had test failures. Assess test performance with group trends and a detailed result table.
SCM - Passed & Failed Tests: This dashboard provides a real-time overview of SCM test results across various assets. Receive a quick visual summary through a pie chart distinguishing between passed and failed tests and a trend line graph depicting the pattern of these results over time.
SCM - Test Results by Asset: See a summary of test results for a selected group of assets. This report can be used to easily identify which assets have the lowest compliance percentage.
SCM - Waiver Details: Use this dashboard to track and manage waivers to internal security policies. Quickly see how many sources, assets, policies, and tests are currently operating under exceptions.
Change Intelligence
FIM - Added | Modified | Removed: Track file integrity monitoring (FIM) changes across your systems with drill-down functionality. This dashboard provides a clear view of all added, modified, or removed files, enabling quick identification of changes that could indicate security concerns.
FIM - All Time Changes: Get a snapshot of FIM data across your systems to track trends in file modifications over time. It categorizes data by severity, rule name, and change type, providing detailed views on modifications per asset.
FIM - Attribute Search: Search and monitor FIM events across a specified time range and filter by attributes like hash value, filename, rule, or user, providing detailed visibility into the changes occurring across monitored assets. This dashboard presents details about modifications to files or elements on monitored servers.
FIM - Authorized | Unauthorized: See a comprehensive overview of authorized and unauthorized changes within monitored systems. Identify unauthorized changes, analyze trends by user, and track frequently changed elements to ensure compliance and detect unauthorized activities. The insights gathered here are crucial for identifying potential security threats.
FIM - Change Summary by Asset: See the number of changes for each asset, including added, modified, and removed elements. It highlights assets with the highest unauthorized change percentage, enabling you to prioritize monitoring and manage compliance effectively.
System
System - Dashboards, Jobs, and Data Performance: This all-encompassing dashboard offers a deep dive into your system's operational health, displaying real-time metrics and historical data on dashboard performance, job execution, data ingestion, and TE server functionality. It's designed to streamline troubleshooting, optimize system maintenance, and enhance performance.
TE SysLogs
Admin Operations Audit Events: See recent activity based on nodes, rules, and duration, as well as activity over time (e.g. last 24 hours). View failed console logins, administrative changes, console session history, and event details.
Changes to Tripwire Enterprise App
Bug Fixes and Improvements:
Changes to Tripwire Enterprise Splunk Technology Add-on
Add-on is no longer needed to support the new data flow that comes via the data adapter
Changes to Tripwire Enterprise App
The app now requires the Tripwire Enterprise Data Adapter to be enabled.
You must install the Universal Forwarder on the TE console.
Installation of the 3.3.0 Tripwire Enterprise App on both the Universal Forwarder and the Splunk Search Head is required.
Changes to Tripwire Enterprise App
The Tripwire Enterprise App for Splunk Enterprise uses the data provided by the Tripwire Enterprise Technology Add-on (TA) for Splunk. The TA must
be downloaded, installed and properly configured prior to using this App.
The following open source components are used in this application:
- https://github.com/twhiteman/pyDes
- Link to project's website: https://www.tripwire.com/resources/datasheets/tripwire-enterprise/splunk
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.