icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Atlas ITSI Content Pack for Pfsense
SHA256 checksum (atlas-itsi-content-pack-for-pfsense_001.tgz) 074e86b078f922d8e10787cd6e7c2469a6a7df2b9ebd6947a9b04cc3fcff7dba
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Atlas ITSI Content Pack for Pfsense

Splunk Cloud
The ITSI Content Pack for pfSense from Kinney Group is specifically designed to monitor and manage the security, performance, and log data of pfSense networks. It leverages Splunk ITSI to provide in-depth analysis and visualization of logs for pfSense, ensuring critical systems are operating optimally. This content pack is an essential tool for IT professionals looking to enhance the reliability and security of their network infrastructure.

The ITSI Content Pack for pfSense contains service definitions and KPIs ready to import to ITSI. The KPI Thresholds and importance values are set to defaults so that they can be tuned manually for your use case. After configuration, this content pack provides a comprehensive monitoring solution for pfSense networks.

Kinney Group ITSI Content Pack Blog

For more information about Kinney Group's Splunk Products, visit our website.


pfSense monitoring encompasses several specialized services, each targeting specific aspects of network performance and security:

  1. Network Security
    • Description: Monitors and manages the security aspects of the network, including intrusion detection and firewall activities.
  2. Intrusion Detection
    • Description: Monitors network traffic for suspicious activities and potential threats using tools like Snort.
  3. Firewall Management
    • Description: Manages firewall rules and logs to control network traffic and prevent unauthorized access.
  4. Traffic Analysis
    • Description: Analyzes network traffic to identify patterns, bandwidth usage, and potential anomalies.
  5. Log Management
    • Description: Collects, parses, and stores logs from various network devices and applications for analysis and troubleshooting.
  6. Bandwidth Monitoring
    • Description: Monitors the usage of network bandwidth to identify high-usage IPs and potential network congestion.
  7. Log Parsing
    • Description: Ensures that logs are properly parsed and fields are extracted for accurate querying and analysis.


Each service utilizes specific KPIs to measure its effectiveness:

  1. Total Data Sent and Received
    • Description: Monitor the total bytes from source and destination IPs.
  2. Snort Alerts
    • Description: Monitor for Snort alerts indicating potential security threats.
  3. Firewall Logs
    • Description: Ensure all logs from pfSense are being sent to Splunk.
  4. Failed Login Attempts
    • Description: Track the number of failed login attempts to identify potential security threats.
  5. Unusual Login Locations
    • Description: Monitor logins from unusual or unexpected geographic locations.
  6. Denied Connections
    • Description: Monitor traffic that is denied based on firewall rules.
  7. Allowed Connections
    • Description: Monitor traffic that is allowed based on firewall rules.
  8. Bandwidth Usage
    • Description: Identify which IPs are using the most bandwidth.
  9. Traffic Flow
    • Description: Monitor the flow of data across network infrastructure components.
  10. Anomalies and Suspicious Traffic
    • Description: Use raw Snort alarms to investigate suspicious traffic.
  11. Log Parsing and Field Extraction
    • Description: Ensure logs are properly parsed and fields are extracted for accurate querying.
  12. Event Details
    • Description: Monitor specific event details for deeper insights.
  13. Error Logs and Alerts
    • Description: Regularly review error logs and set up alerts for critical issues.
  14. Network Throughput
    • Description: Monitor the usage of network bandwidth to identify high-usage IPs and potential network congestion.
  15. Data Integrity and Completeness
    • Description: Ensure all expected data is being ingested without loss.


* Source: [Trenches of IT](https://www.trenchesofit.com/2020/04/14/building-a-splunk-dashboard-for-pfsense/)
* Source: [Splunk Documentation Network Traffic](https://docs.splunk.com/Documentation/CIM/5.3.2/User/NetworkTraffic)
* Source: [Splunk Documentation Authentication](https://docs.splunk.com/Documentation/CIM/5.3.2/User/Authentication)



Services are interconnected; for instance, Network Security is dependent on Intrusion Detection and Firewall Management. Similarly, Traffic Analysis relies on Bandwidth Monitoring to identify high-usage IPs and potential network congestion.

Hierarchical Structure:

Some services form a hierarchy, such as Network Security depending on Intrusion Detection and Firewall Management, illustrating a layered approach to performance monitoring where base metrics support broader performance indicators.

Release Notes

Version 0.0.1
May 23, 2024

Initial release

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.