Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cy 514 add the panel and alert for windows firewall status #341

Merged
merged 6 commits into from
Jul 27, 2023
Merged

Cy 514 add the panel and alert for windows firewall status #341

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ae6147e
CY-514: Added the alert for windows firewall status
hardikhdholariya Jul 12, 2023
24e9a9a
CY-514: Added the panel for windows firewall status
hardikhdholariya Jul 12, 2023
e27e202
CY-514: Updated the macro name
hardikhdholariya Jul 12, 2023
8e152ae
CY-514: Added the macro for firewall status logs and added the inline…
hardikhdholariya Jul 12, 2023
00c1bd8
CY-514: Updated as per the review comments
hardikhdholariya Jul 13, 2023
41721e8
Merge branch 'master' into CY-514-add-the-panel-and-alert-for-windows…
hardikhdholariya Jul 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions cyences_app_for_splunk/default/data/ui/views/cs_windows_reports.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,4 +152,52 @@
</html>
</panel>
</row>
<row>
<panel>
<title>Windows Firewall Status</title>
<input type="time" token="time_Range">
<label>Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
<change>
<set token="form.fw_host">*</set>
</change>
</input>
<input type="dropdown" token="fw_host" searchWhenChanged="true">
<label>Host</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search>
<query>| tstats count where index=* AND sourcetype=WindowsFirewallStatus by host
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
| table host</query>
<earliest>$time_Range.earliest$</earliest>
<latest>$time_Range.latest$</latest>
</search>
</input>
<table>
<search>
<query>index=* sourcetype=WindowsFirewallStatus host="$fw_host$"
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
| stats latest(Domain_Profile_Status) as "domain profile status" latest(Private_Profile_Status) as "private profile status" latest(Public_Profile_Status) as "public profile status" by host</query>
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
<earliest>$time_Range.earliest$</earliest>
<latest>$time_Range.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="domain profile status">
<colorPalette type="map">{"ON": #03991a, "OFF": #a3030b}</colorPalette>
</format>
<format type="color" field="public profile status">
<colorPalette type="map">{"ON": #03991a, "OFF": #a3030b}</colorPalette>
</format>
<format type="color" field="private profile status">
<colorPalette type="map">{"ON": #03991a, "OFF": #a3030b}</colorPalette>
</format>
</table>
</panel>
</row>
</form>
4 changes: 4 additions & 0 deletions cyences_app_for_splunk/default/macros.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -682,6 +682,10 @@ iseval = 0
definition = search *
iseval = 0

[cs_windows_firewall_is_disabled_filter]
definition = search *
iseval = 0


# Sysmon
[cs_sysmon]
Expand Down
37 changes: 37 additions & 0 deletions cyences_app_for_splunk/default/savedsearches.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -926,6 +926,43 @@ action.cyences_send_email_action = 1
action.cyences_notable_event_action.products = Sysmon


[Windows - Windows Firewall is Disabled]
disabled = 1
enableSched = 1
alert.track = 1
alert.severity = 4
alert.suppress = 0
counttype = number of events
quantity = 0
relation = greater than
cron_schedule = 2 * * * *
description = The alert will be triggered if the Windows Firewall has been disabled from its active state in the past 24 hours. \
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
Data Collection - Windows Firewall Status Check Add-on (https://splunkbase.???????)
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
dispatch.earliest_time = -24h
dispatch.latest_time = now
display.general.type = statistics
display.page.search.tab = statistics
display.page.search.mode = fast
request.ui_dispatch_app = cyences_app_for_splunk
request.ui_dispatch_view = search
search = index=* sourcetype=WindowsFirewallStatus \
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
| dedup 2 host \
| stats latest(Domain_Profile_Status) as Domain_Profile_Status latest(Private_Profile_Status) as Private_Profile_Status latest(Public_Profile_Status) as Public_Profile_Status earliest(Domain_Profile_Status) as Previous_Domain_Profile_Status earliest(Private_Profile_Status) as Previous_Private_Profile_Status earliest(Public_Profile_Status) as Previous_Public_Profile_Status count as event_count by host \
| eval changed = if((Previous_Domain_Profile_Status="ON" AND Domain_Profile_Status="OFF") OR (Previous_Private_Profile_Status="ON" AND Private_Profile_Status="OFF") OR (Previous_Public_Profile_Status="ON" AND Public_Profile_Status="OFF"), "Yes", "No") \
| search (changed = "Yes") OR ((event_count=1) AND (Domain_Profile_Status="OFF" OR Private_Profile_Status="OFF" OR Public_Profile_Status="OFF")) \
| rename host as Host \
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
| table Host Domain_Profile_Status Private_Profile_Status Public_Profile_Status \
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
| eval cyences_severity = case(Public_Profile_Status="OFF" AND Private_Profile_Status="OFF" AND Domain_Profile_Status="OFF", "critical", Public_Profile_Status="OFF", "high", true(), "medium") \
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
| `cs_windows_firewall_is_disabled_filter`
action.cyences_notable_event_action = 1
action.cyences_notable_event_action.param.filter_macro_name = cs_windows_firewall_is_disabled_filter
action.cyences_notable_event_action.contributing_events = index=* sourcetype=WindowsFirewallStatus
VatsalJagani marked this conversation as resolved.
Show resolved Hide resolved
action.cyences_notable_event_action.system_compromised_search = | stats count by Host
action.cyences_notable_event_action.system_compromised_drilldown = index=* sourcetype=WindowsFirewallStatus host=$row.Host$
action.cyences_send_email_action = 1
action.cyences_notable_event_action.products = Windows


[AD - Group Changed]
disabled = 1
enableSched = 1
Expand Down
Loading