The following is information related to the use of the add-on with Splunk Enterprise Security

Below is a list of all out—out-of-box dashboards for Enterprise Security, version 8.0, that will show data when using the OMNIS AI Streamer CIM Add-on. The dashboards listed below rely on Splunk CIM data models (Networking Traffic Web, and DNS, SSL, E-mail) and are based on flows enabled in Omnis AI Streamer (see installation instructions). Flows used in ES dashboards include Base, SMB, ICMP, DNS, HTTP(s), Certificate and E-mail flows.

Please refer to Splunk documentation for dashboard and panel details. All fields listed are CIM compliant and support Splunk Enterprise Security.

Analytics – Security Intelligence - Protocol Intelligence Dashboards/Panels:
• Protocol Center - Provides an overview of security-relevant network protocol data
• Traffic Size Analysis - Compare traffic data with statistical data to find outliers, traffic that differs from what is normal in your environment.

Source types: Base, SMB, ICMP flows 
• netscout:omnis:flow:base  
• netscout:omnis:flow:smb    
• netscout:omnis:flow:icmp

• DNS Activity - Displays an overview of data relevant to the DNS infrastructure being monitored

Note: BY default the Add-on only shows DNS Query information only (message type is Query), if required this can be set to DNS Response Information (message type is Response) only. By changing the CIM model mapping. Both can not be shown at the same time

• DNS Search – Enables ad-hoc search of DNS data refined by the search filters

Source types: 
• DNS flows (netscout:omnis:flow:dns)

• SSL Activity - Displays an overview of data relevant to SSL being monitored
• SSL Search – Enables ad-hoc search of SSL data refined by the search filters

Note: The src and dvc are currently set to the AI Streamer address seeing the certificate data

Source types:   
• Certificate flows (netscout:omnis:flow:certificate)

• Email Activity - Displays an overview of data relevant to the e-mail traffic being monitored
• Email Search – Enables ad-hoc search of email data refined by the search filters

Source types:   
• POP3 flows (netscout:omnis:flow:pop3)  
• IMAP flows (netscout:omnis:flow:imap)  
• SMTP flows (netscout:omnis:flow:smtp)

Analytics – Security Intelligence – Web Intelligence Dashboards/Panels:
• HTTP category Analysis – Investigate HTTP category data and determine if there is a possible threat to your environment.
• HTTP User Agent Analysis – Investigate user agent strings in your proxy data and determine if there is a possible threat to your environment. Abnormal or long user strings may indicate a threat.
• New Domain Analysis – Reports any new domains that appear in your environment. These domains can be newly registered, or simply newly seen by Enterprise Security
• URL Length Analysis - Looks at any proxy or HTTP data that includes URL string information

Source types: https, https flows  
• netscout:omnis:flow:http  
• netscout:omnis:flow:https

Analytics – Security domains - Network Dashboards/Panels:
• Traffic Center - Profiles overall network traffic, helps detect trends in type and changes in volume of traffic, and helps to isolate the cause (for example, a particular device or source) of those changes. This helps determine when a traffic increase is a security issue and when it is due to an unrelated problem with a server or other device on the network.
• Traffic Search - Search network protocol data, refined by the search filters.
• Port; Protocol Tracker – Tracks port and protocol activity
• Web Center- reports on proxy servers to help profile web traffic in an environment
• Web Search – can be used for ad-hoc searches of web events that are of interest

Source types: Base, SMB, ICMP flows, https, https flows 
• netscout:omnis:flow:base
• netscout:omnis:flow:smb
• netscout:omnis:flow:icmp
• netscout:omnis:flow:http
• netscout:omnis:flow:https