Using Chart

0:00Welcome back and this time we are diving more into Splunk and a Power User. Now, before

0:06we get underway and into the weeds on the actual technicals and getting into labs and

0:10all that stuff, a quick refresher if you will. There is a link below this video, yes right

0:17below this video, that takes us back to the actual Splunk core certification course. So

0:22if you want to be able to get the basics in, let's say you've gotten this course first

0:28and you're like, I want a little bit more basics before continuing, that course is right

0:32below. That being said, I don't want you to think that the two courses are reliant upon

0:37each other. We make these courses and skills to be more standalone, so that way if you

0:43start here and go through the entirety of the course overall, you should have a very

0:48firm understanding of what it is that we're getting into. But just in case you want that

0:53little beginner or refresher, if you want to go back and kind of freshen up a little

0:57bit, it is below. Now that being said, the difference between that course and this course

1:02is the actual word of power in terms of Power User. That's right. See, in the previous course,

1:10we covered Splunk user capabilities as in terms of like, you know, in a SOC, Security

1:17Operations Center. Somebody's just in as a regular user inside of Splunk and they're

1:22able to pull up basic reports and features, get some information from search results in

1:28the SPL, all sorts of great stuff. But as we continue on and we want to be able to customize

1:34and make Splunk work more for us in ways that we need that are more tailored to our organization,

1:42we need more permissions and more capabilities. And that's where the actual Power User comes

1:48into place at. See, it's not all the way the administrator of Splunk itself, but it

1:55does carry with it a little bit more weight in terms of configurability and also flexibility.

2:01Now we'll cover real quick just the basics between a standard user and a Power User.

2:08Not that that's really going to have a full force effect on the rest of this course, because

2:14we're more focused on actually using and leveraging Splunk in that power mode. Now,

2:20the account that we have inside of Splunk does have a lot of administrative privileges already

2:26using the learner. And in fact, if you look below where the lab link is inside of the skill,

2:32you'll see a little sticky with the username and passwords. That'll become more important

2:36here very shortly. That being said, the way this lab was set up doesn't truly define differences

2:43between regular user and Power User, because we had to make some modifications to make it a

2:48debt lab friendly. So that's why I wanted to cover with you the differences between standard user

2:54and Power User before we moved on. And as a standard user, our primary focus was basically

2:59searching, analyzing data and personal reporting, tailored to me, the individual. And as a Power

3:07User, we start building shared knowledge objects to be able to share throughout the actual

3:12organization itself and optimizing team workflows. So instead of just making it just for me,

3:18let's say I'm the actual sock shift leader for nighttime, which is what I did in the army for a

3:23good bit. I would make those dashboards and search queries and alerts for our team and

3:31nighttime monitoring and the overall OSC or officer in charge would have their own flow of

3:37things that they would do that we would monitor as well. So a power, power user, if you will.

3:43Now that trickles down into what we know already is like different properties of different level

3:51accounts with permissions. Just applying that mindset into Splunk itself is what we're going

3:56to be working with throughout the rest of this course. Now, as a power user, you're going to

4:02have more object ownership, the more capabilities to save searches and actual alerts. Now this ties

4:10into the actual dashboard capabilities as well, along with the detailed searching terms that you

4:18want to be able to use. Now, like for example, in this skill, we're actually going to be getting

4:22into chart pretty quickly. This shows us how we can actually optimize the data that comes up in

4:28the actual inputs. Now that takes us into why are we doing this as a power user? Well, as a power

4:36user, we are able to make the information display pretty is the very simplistic way of putting it

4:44and creating those workflows for our teams. Allow is a way for us to be able to make the information

4:52that is being ingested into Splunk more manageable and less scary for everybody working with Splunk

5:00or in the SOC overall. We may have certain methods, operating procedures, SOPs, policies,

5:07whatever the case may be within our organization, the states, how we have to actually handle certain

5:12types of information and long events. And that plays into a large part of what's going inside

5:19of this particular course. Do remember this though, regardless of how it is that we as

5:24individuals want our actual Splunk in the enterprise environment, always consider and,

5:30you know, take into account the corporate policy set forth by either the CEO, CIO, CISO,

5:38anybody in that C-suite that is directly above. Now, if you are that CIO, CISO, good for you.

5:45And I hope you take into this, into some bits of advice for the actual workers inside of the SOC

5:53working in with Splunk and also regurgitating those events in ways that make it pretty for

6:00the executive suite.

0:01I wanted to start off with some lab notes for you real quick.

0:03If you have not taken the previous course, that's okay.

0:06Remember that. That's perfectly okay.

0:08But if you're starting here, there's a couple of things I want to get you used to real quick.

0:12What we are taking a look at here is going to be the general lab that we use throughout the rest of this course.

0:17And one thing that you'll notice is that when the lab starts up, you get this virtual machine connection error.

0:22I have not figured this out yet, and I apologize.

0:25But all you got to do is just click OK.

0:27After that, we're going to go inside a Splunk VM that's on the top right.

0:32And if at any point, let's say you're in a different skill,

0:35and you don't see the sticky inside of this particular skill next to the actual lab link itself in here,

0:42that's okay. There's a text document on the desktop called passwords.txt.

0:47And this is split up between two credentials here.

0:51First, you have Splunk VM, which is the actual top right VM that you're going to be using Splunk out of.

0:57And then the Splunk UI that gives us the username and password for being able to go into Splunk itself,

1:04because we have Splunk pre-installed with a pre-configured data set as well.

1:10Now, I'm not going to put the link to the actual data set in here, in this particular skill yet.

1:15We have it in here, and we'll start talking about how that plays a factor into our data momentarily.

1:23Just know that in the previous course, we have that configured for you as well,

1:27along with where to get that basic information if you want to build one of these at home yourself.

1:33Do keep in mind that the data set that we are using is under the limitations of expensive pricing for Splunk licensing.

1:41So you may not get the full immersion experience inside of Splunk for data reports,

1:47but there is a large amount of data that's still in here.

1:50That being said, your organization may have 10 times as much information as being ingested into its database.

1:57And if that's the case, expect time differences to vary between real life and what we have here in the DevLab.

2:05And we see here that we have Splunk on localhost.

2:08You may have to go in and press start, but it's at a save state.

2:12It may take just a couple of minutes to fire up and warm up for you and have the services running.

2:18I tell you all this to kind of prep you for the actual rest of the course overall as we start getting into church.

0:00As we continue throughout the skills and of course you may see some little time jumps here and there and that's because I'm cutting out a lot of the waiting time.

0:07So let's go ahead and start out up here over there with logging into our Splunk UI and that is again in the sticky note upstairs and we are going to start off with a learner and go ahead and sign in and there's a couple things I want to show you here real quick once we get inside of Splunk.

0:25Once we're logged in, we're taken to our default screen inside of Splunk because nothing has been set up yet in terms of like dashboard and all that other great stuff.

0:34There's a couple of tidbits I'd like for you to keep in mind as we do throughout this course together.

0:39First, let's go down to search your data and that will be on the main bookmarks page of Splunk when you first log in.

0:46I'm going to zoom in for you here real quick so you can see it.

0:49Search your data.

0:51Now this is the standard SPL and when we go in here, you'll see that we have a search bar and SPL search history.

0:59There's two things to keep in mind here.

1:00Number one is the primary index that we will be searching through is index bot SV3 and I will have this in a code box below for you.

1:11Now along with that, we need to understand that the data set that we have in here is a tad bit dated a couple of years in fact.

1:19So if you're wanting to do a raw search like this inside of index bot SV3, you will need to go to this drop down just to the right of the search bar up yonder and select a time range of all time just to get an idea of how all of this information comes up.

1:39And as we sort through here, notice that it is taking a second to load the information up, but you are getting events that have been ingested into Splunk.

1:49Now this was a predefined data set and normally you would have ingest points and also forwarders, either normal forwarders or heavy forwarders going into Splunk itself, but this is the actual information that you'll be getting in the actual raw data form.

2:06And that brings us into the main focus of the skill and that is creating charts out of this, because we can go through here and search specifically for different things and different events, so to speak, as granular as we want to or as broad as we want to, but as we are creating our dashboard events or something for our team to use,

2:34we would want to use a chart to be able to represent something pretty simplistic to view, especially when you're dealing with the executive folks. Now, I'm not trying to pick on executives or anything like that, but I will pick on army officers, because army officers love green and whenever something is not green, they panic.

2:54So when they see the charts that we will develop in here, if there's any red on there, they will panic, but that's just their nature. But the charts are for us to be able to get a quick visualization of what's actually happening within different points of our data that were specifically highlighted inside of our index or data set.

3:16And remember, you can have multiple data sets inside of your Splunk. I don't have that here in this lab, but we are simulating the fact that we have multiple sets by setting index equal bot SV3 as our primary search index or data set.

3:36Now, as you can see here, I have gone further by refining my search results, not just inside of index bot SV3, but I have also searched, as I zoom in for you, my source of stream semicolon, colon, semicolon DNS, meaning I'm looking at all the events within my data set of bot SV3 that match a source of stream DNS.

4:03You can see that first event there that happened on 8-20-18 at 8-18 a.m. If we go ahead and scroll that down, you can see in there where we will have a source of stream DNS, specifically like with destination port 53, that port lining up to be in DNS.

4:26Now, there's more that you can take out of this as well, too, but you'll also notice specifically as I zoom in for you, there are 175,094 events that match the criteria for what we just put inside of our search bar of index and then the actual source of stream DNS.

4:46So, there's a lot of events that match this broad spectrum criteria, but in order for us to be able to visualize what's actually happening a little bit further, we can implement the command of chart, and we will do this by including a pipe.

5:01We usually shift right below the delete key on the backspace key on the keyboard, so top right section, and I'm going to paste one in here for you, chart count by source IP address.

5:16So, what we want to do is create a chart that is giving us a count by the actual source IP addresses, count meaning that it's going to count the number of occurrences each source IP address that's unique pops up inside of our actual count here.

5:35And when we search for this, do know that it may take a few minutes or seconds, depending on how you start this VM up or have your own server running, but as you can see here, we have a chart now of all the actual source IP addresses.

5:51You can see that on the left, we have the individual IP addresses, and then on the right, the actual counts that they actually came into. Now, don't worry, we will be getting more into different types of charts and everything like that later on. I just wanted to give you a basic of what the actual chart is and can do.

6:10So, as we scroll through here, we are seeing that we have all those unique IP addresses and the number of times that they come up. So, on the left, you can see that we have, for example, 172.16.0.13. On the right, you can see that it appeared 6,041 times.

6:30And we are not sorting by the count, but in a fashioned order of numerical sense inside of our actual source IP, which was inside of our actual search criteria for the actual chart itself.

0:01Now where we left off allows me to show you and demonstrate the differences between chart and stats.

0:07What we're really taking a look at here, even though we use the chart command as a pipe on the actual search itself to give us the information that we requested,

0:16we are actually taking a look at a stats representation.

0:20And as you can see, this is not a chart by any means whatsoever.

0:26So what is the difference between stats and charts?

0:29Now stats is what you see here just by the numbers or by the raw data broken up into statistical representations of numerical counts.

0:39And the actual chart is going one step further to display it in prettiness.

0:46And we do that by zooming in and you see where stats 35 has a square around it.

0:51We want to go into the actual visualization.

0:54So let's take a click on the visualization, scroll down, and now you see a chart.

1:00That's right. All the different pieces of information that we got out of our specified search using the chart pipe,

1:08allow us to be able to create a representation in chart form.

1:13And if we scroll down even further, we can see that all our actual data is right below it.

1:19Now we can hover over these different points of data inside of our chart and see the actual source IP address and count.

1:28I will zoom in for you.

1:30This is important because this is specifically what we requested inside of our search itself when we said by source IP address.

1:38And also keep in mind that the basic of the search itself was through stream colon DNS.

1:48So if we took out the source type of stream DNS, you would see all the pieces of data here,

1:55and the chart would be created based on the actual source IP address that we put into our pipe command.

2:02Basically we're just segmenting the different searches, the broad search,

2:07to give us a more detailed view of what's happening inside of our data set.

2:12Now the more that you're actually looking for in terms of search criteria, the more you focus in on that,

2:20the more detailed that your chart is going to be.

2:23You will see that this is based in two different categories,

2:27meaning that the x-axis here is the source IP address that we were searching for,

2:33or sorting by, and that the count is the y-axis.

2:38So if you look, you can see that it goes all the way up to 40,000.

2:42Now it's not 40,000 that you're going to see in there, but you will see some because the chart is sorting by 10,000 here.

2:49The source IP address 17231-1276 has a count of 28,804.

2:57And on the source IP address, again, it's getting some semblance of numerical ordering for us to be able to compare to.

3:07Now you can go even further by making this chart more customized for you.

3:13And you do this by going to the top left of the actual chart itself to select the actual visualization.

3:20Some of these words are tongue twisters, bear with me.

3:23You can see that we have all sorts of different visualization types,

3:27and I do want to point out that if you click on Find More Visualizations here,

3:31you aren't really going to get anything back because we have the internet turned off for the actual Splunk VM itself due to how Splunk operates.

3:41But that's okay. The basics are what we really want to have in here.

3:46You have bar graphs, you have pie graphs, you have scatter charts,

3:49you have all sorts of different things that make you shudder and happen to go through stats,

3:53which ain't a math class inside of a graduate course.

3:58So as a demonstration, let's pick on the actual pie chart for a second.

4:01And you can see here that this is what we get.

4:04Not only do we get the IP addresses in IPv4, but you'll notice on the top left there is an IPv6 address as well.

4:13And it gives us many, many different colors to represent the slices of the pie

4:19that each one of those source IP addresses that was searched for in our initial search represents a different color.

4:28So if you were to click on one of these, what would happen instead of just hovering over it?

4:33Because we're hovering over orange here, and it tells us the actual source IP address,

4:37the count, and the actual count percentage of the overall search criteria.

4:43Well, if we click on it, we can go to see that it gives us a very detailed view of the actual search criteria.

4:55Instead of putting chart command in there, it modifies the SPL to say,

5:00index our data set, the source that we've already been looking for,

5:04and now it modifies it, takes out the chart, with the actual source IP of 172.16.0.178.

5:12Now look, I want to show you something.

5:14You'll notice that we still have that visualization tab.

5:18And if you click on it here, you'll notice that there's nothing there.

5:22Why is this? We didn't chart, that's why.

5:25But we can go back to the actual events, which are 23,966,

5:30and create a chart on that based on what we want to count by.

5:38And in this particular instance, I just pasted that in there because it's what I copied from the previous search.

5:43I want to do a chart count by, not source IP, because we're already doing a broad search by that.

5:49Let's say, let's scroll down and take a look at this one here, or a couple of them here real quick.

5:55Let's say, destination IP, DEST underscore IP.

6:03And do a search on this.

6:06And you'll notice that when it finally loads up, we have our destination IP from our source IP.

6:14But when we go into visualization, we now have a chart.

6:18Now is this very detailed information for us to know?

6:21No, I picked the wrong field to be searching by, from source to destination.

6:26My bad.

6:27But you get the idea now that we have invoked chart.

6:31Chart now knows to run for the visualization because of the sub pipe command on the actual search itself.

0:01Now as you see here on the screen, I already have a chart created and I'm going to explain this for you, so fret ye not.

0:07What I've done is I've searched the actual index that we have our data set in that's default for us in this lab for an event code of 4625.

0:19Now this is specific to Windows operating systems and event ID 4625 on Windows systems are failed login attempts.

0:27And I went ahead and did a pipe to chart to be able to count by the number of hosts.

0:34And when we go to the visualization of this, you can see here that these are all the hosts within our data set that have failed logon attempts to them.

0:45And I've customized this to a pie graph because I like pie.

0:50And the next thing you may be wondering is that, okay, well, this is all good and everything, but how do we keep an eye on this?

0:58Because this can increase if somebody starts logging into a system multiple times and fails continuously.

1:06So how do we keep it to where the actual pie chart is consistent with actual live data?

1:15Should we have it just for R or a Splunk? I'm glad you asked.

1:19If you look up at the top, you'll see save as right above where it says time range in our drop down menu.

1:27And there's a couple options that you could do here.

1:29One is add it to an existing dashboard or create a new dashboard with it.

1:34And this is where all the dashboards inside of Splunk generally start beginning life at.

1:40Because we do a search, apply criteria like chart and other things that we'll see later on, and then we take that and apply it to an actual dashboard itself.

1:53So we're going to create a new dashboard with this.

1:55In this dashboard title, I'm going to close out of that demo right there, we're going to call this failed logins.

2:04And I don't really need to add a description in there, but right here you'll see in the permissions that this is where the actual power user permissions come into play here.

2:16Because we can set it to private and that's available to every single user regardless of permission levels, but it's only available to us.

2:25Whereas if we share it in the app, it's visible to app users and can be elevated by our power user status to be shared to people within our team.

2:37And this is why being a power user and leveraging Splunk in this manner is pretty important.

2:43Because we can create all this and not have to reinvent the wheel with every single person on our actual teams.

2:51Whether night shift, day shift, or it doesn't matter where they work at.

2:55As the manager, you're going to create what's actually important to be monitored and the individual users inside of Splunk are going to be able to create their own dashboards, of course.

3:07But it will complement what our actual focus is from the management level.

3:14And while the managers that are creating this inside of Splunk may not typically be the C-suite folks, we are getting that directive from the C-suite in order to be able to create something like this.

3:25So we're going to say share in app and then you have a couple of options.

3:30Classic dashboard or a dashboard studio.

3:33We're just going to go with classic dashboard and I'm just going to call the actual panel title failed login attempts.

3:43Make sure I spelled that right.

3:45And you see that we have the visualization type I put in pie chart.

3:49We can scroll down and make sure that everything's good.

3:52But now I can just save this to dashboard.

3:55Now the panel has been created and added to failed logins.

4:01You may now view the dashboard.

4:03So let's go view the dashboard.

4:05Now inside of the actual dashboard itself, you're going to see where it says waiting for data.

4:11This will update as more information flows into the actual Splunk ingest point.

4:17So if you have multiple Splunks that are important within the organization, you may have to wait a few minutes before everything starts talking all together, depending on latency, speed of the network, etc, etc.

4:28But this is the actual representation of what we just looked for in chart form inside of our actual Splunk search, which narrows down exactly what it is that I as a manager am looking for with interest.

4:42Because now I can just hover over and say, well, host SEPM has had two failed logon attempts.

4:48Now there is more context missing from this, but I wanted to give you the basic level scratch surface type thing.

4:56Are those two failed logon attempts repetitive, like within a second?

5:00If they're within a second, then it's probably automated and malicious in nature.

5:08If it's spread out over like a minute or so, somebody probably fat fingered something or they just said, I missed the first time.

5:18Take a deep breath.

5:19I'll come back and try again later.

5:21These don't really ring alarm bells to me as a SOC manager, but I want it to be noticed on the actual dashboard itself.

5:29And as like I said, as you start getting in more information through the actual Splunk, through your forwarders, this will grow depending on how many failed attempts actually happen.

5:41But keep in mind too, this does not cover POSIX based systems like Unix and Ubuntu, Kali, etc.

5:48This is more focused on the Windows side because what do we do?

5:52Well, we search by event code, event type inside of Windows.

5:57We can double check this by going to the left side of the screen, going into search and expanding our SPL history.

6:06You can see that we actually search for event code 4625, charted it by count by host, which is how we got that pie graph after we changed visualizations and stuff.

6:17But wait, I hear you say, where's the dashboard at?

6:21Glad you asked.

6:22On the top left, you'll see the three lines there below where it says Splunk.

6:26Click on that and go to where it says dashboards.

6:30I have my mouse on it.

6:31I'm going to zoom in for you right there.

6:33It's the second one from the bottom right above modules.

6:37You can click on dashboards, go into your actual dashboard listings and see here where the dashboards are being created, shared from, etc.

6:48And the private ones will list in here and the ones shared with you will be listed in here as well.

6:55If you're a power user managing a team inside of a SOC, those individual Splunk users with just general user permissions will be able to go into their dashboards and see all the different dashboards that have been created or assigned to them.

7:11I come in, I'm a user, I want to look at what's going on and the focus from the boss tonight is failed logins.

7:18So I can very easily go to failed logins, pull up the dashboard and not have to go through all the actual searching in SPL to create the visualization that we have here.

0:00Now you may have noticed that I have changed up my SPL query here for my searching. I'm going to zoom in and show you what I'm talking about.

0:08I am still searching for failed logon attempts, but as you can see here, now I'm piping to a new command.

0:16Time chart, where we jump in our DeLorean and go 88 miles an hour back to 1985 to figure out who did this and when.

0:25You can see that I am sorting in my stats view by time and our time is in 2018.

0:32So this is going to be a little tricky to demonstrate and explain for you because there's a lot of neat things that you could do with time chart.

0:39Unfortunately, with our data set in this test environment, we cannot leverage or demonstrate near any of them.

0:46The time chart allows us to be able to put a time stamp on everything we've already been through with the actual charting command itself that was piped into our search.

0:58So now we're putting a time principle on what actually happened within the organization.

1:05If we remember in the previous chart that we just saw how many failed logon attempts there were, not when they happened or the span of when they happened.

1:14I tease that for a very specific reason because that just gives us the overall view of how many failed attempts there were overall.

1:22But when you start getting into time chart, we can actually narrow this down and have a more detailed view on things that happened within a specified time frame.

1:33And again, this is going to be a little bit difficult to demonstrate, but allow me to regale you here for a second.

1:41So let's say that we have on our dashboard, and you'll see this momentarily, a chart for our failed logins and a chart of all time.

1:49And then a chart to show recent failed logins with a span in there to show us how often they actually happen.

1:59So remember within a minute or two or within a full second, that raises eyebrows.

2:06So here you can see that I have time chart count by user.

2:10So now I'm trying to get a count on the actual users and how many times they failed logins so I can kind of pinpoint where my failure point is.

2:19And I can go into visualizations for this and see, you know, bar graph is by default, but I'm going to select pie graph because it's a little bit easier.

2:28You can see that, you know, if I scroll down, guest seems to be a big one here and causing the problem.

2:37Now again, this is going to cause a little bit of frustration because we can't demonstrate this live.

2:44But if you allow me, but allow me here for a second to entertain you.

2:52So if I were to go into my search bar and then after time chart said span equals five minutes, 5M, and then press enter,

3:04we're not going to have anything come up because we don't have live data being ingested into this actual Splunk itself.

3:10Well, here we go. Proving me wrong.

3:13So these all happened within five minutes of each other.

3:16So these two right here happened within that time frame.

3:21And that may or may not raise eyebrows to you.

3:24So you may say, I want to track failed login attempts for, let's say, if they happen within five minutes or two minutes or one minute, right?

3:36By each specified user within the organization.

3:41Along with having on your dashboard, the systems in your chart that show you the overall chart event IDs of failed logon.

3:51You can compare those two and see if there's an actual system under duress or a user account that is being leveraged or trying to be leveraged as a security manager.

4:03Now, the best question here is, is how do we put these two together?

4:07Well, this too will go inside of our dashboard, if you want.

4:12That's for you managers out there.

4:15We simply go to save as, and then this time we're going to go to an existing dashboard.

4:20And we can just drop down and see that we have failed logons.

4:25Now, I'm going to call this one time span 5M for five minutes and then save to dashboard.

4:36And we're going to go ahead and click on view so we can see them put together and how this works out for us.

4:42Now, this data is still coming in.

4:45As you can see there, we have the systems up here that had failed logon attempts to them on the actual systems themselves.

4:51And here we saw that a user meeting the criteria of having failed logons within that five minute span.

4:59Now, this will also update and will get more muddied up depending on when that time period passes in real time environments.

5:09So, just open mind here.

5:12Know that in a real Splunk environment, you can set this criteria up to where it will auto refresh in your dashboard using that five minutes.

5:19So, let's say a user comes in right this second and says, failed logon attempt, failed logon attempt, failed logon attempt.

5:26And it's going to pop in that bottom pie chart for us and update instantly because we have data that's constantly being exported or imported into our Splunk.

5:39And you can even see down on the bottom right that we have a refresh button to allow us to be able to manually refresh the update on this because it does it every minute or so.

5:50If you want to be able to have eyes on real close and make sure that nobody's blinking at you out of nowhere on this, you can hit refresh, refresh, refresh.

5:59I can't say it that fast too many times, but you get the idea.

6:03So, time chart is a play on the actual chart itself, but allows us to be able to see charting in a small snippet of time instance, almost like time traveling.

6:17Thank you.

0:01We're going to wrap things up with a challenge by covering our knowledge of the command of chart inside of Splunk.

0:08Now I'm going to give you a few hints and everything to get you ready right below this video so that way you're not too out there.

0:15Because some of you may or may not be familiar with Windows. Some of you may be more familiar with Mac or POSIX based systems and that's okay.

0:24So now what we're looking for is inside of our data set the number of users that have been created through all time in a chart by user.

0:36So again I'm going to put the actual SPL below but where the challenge comes in here is that not only do you need to be able to search for this through all time.

0:47But also add it to a dashboard or create a new dashboard for it as well too.

0:53So that way it can be shared amongst your team members in the rest of the organization since we are managers of the SOC in this exam.

1:02So I'm going to let you do it and then when we come back in the actual solution we'll walk through it together and see if we got it.

1:09Be right back.

0:00Now in our challenge we set out to see if we can create a chart of users being created within our

0:05organization. A couple of things to keep in mind is that I gave you the search criteria for SPL

0:10inside of Splunk in the challenge. And we need to make sure that our time is set to all time.

0:17And I was doing this thinking that I was already on the screen. I wasn't. So here we go. Now after

0:22having ran our actual search criteria, we can see that only one account has been created. The actual

0:28as I zoom in for you SVC VNC. Again this is only a Windows account creation because we're

0:34searching for it by event code 4720 which is native to Microsoft as an event ID for account

0:41creation. So I should say that we're looking for accounts created in Windows. Whether it be on a

0:48local system or in Active Directory, it doesn't matter. If we have all systems reporting to our

0:53Splunk for forwarding events, then that means that we're going to catch all of these events

0:59coming from Windows regardless of whether it's a workstation or actual domain controller. And you

1:05can see that we're creating a chart count by user. And so in order to turn this into an actual chart

1:12itself to take it to our dashboard, we're going to go to visualization. Now as the accounts are

1:19created throughout the organization, you will see this populate and you will see it also go through

1:26and expand. But in order for us to do this real quick, we want to go ahead and export this by

1:33save as to a new dashboard. And here we're going to say new accounts description and it's up to you.

1:45But here in the permissions is kind of what I wanted you to really focus in on. And that is

1:50dashboard type is either going to be private for an individual or if you're a manager that needs

1:55to share this with your team or organization, it needs to be shared in an app to make it visible

2:00to other users. And whether you click a classic dashboard or dashboard studio is up to you.

2:07But I am going to call this user creation under the actual panel title. That's the subsection

2:14within the dashboard itself. And save to dashboards. And then I'm going to go view it.

2:21And we can see here that we just get the basic bar graph when it pops up, boom shakalaka. And

2:26inside we see that our one account has been created. Now we can go in this and get further

2:31details, but I wanted to show you as well too as a reminder, on the left when we go into dashboards,

2:37you will see here that now we have another dashboard for new accounts and failed logins.

2:46Look on the far right and see if it's a sharing, if it's global, if it's app, if it's who has

2:53permissions to it and you can get with the owner of that actual dashboard to see if it's available

3:00to you or can be made available to you when you're doing your time on the Splunk inside of your

3:06night shift. I do night shift because I can get away with playing games, right? Of course not.

3:12We always take night shifts seriously. The important thing is here that we know that

3:16we can start creating charts that will natively update themselves automatically based on the

3:21amount of data being ingested into our Splunk. And as we start receiving more data, the charts

3:28start getting bigger and more detailed and we can formulate these charts to be more, let's say good,

3:35bad, ugly, somewhere in between or to find how we see fit for our dashboards in the future. So this

3:43allows us to be able to put a pinpoint visual on things that we absolutely want to keep track of,

3:48but in pretty colors and also keep a couple of charts going to see if it matches a certain

3:55time span criteria using time chart. But I want you to keep this in mind as we move forward and

4:01start including all of this together as a power user inside of Splunk.

4:05I hope this has been informative for you and I'd like to thank you for viewing.