Skip to content

Commit baa5d9d

Browse files
chchhsiaoDeepSecurityOpenSourceSupport
chchhsiao
authored and
DeepSecurityOpenSourceSupport
committed
DS-23230 Support applciation control
1. Add index for application control events. 2. Create dashboard and saved search for application control events. 3. Consist the label/title cross dashboards
1 parent cc217fb commit baa5d9d

File tree

7 files changed

+116
-21
lines changed

7 files changed

+116
-21
lines changed

‎TrendMicroDeepSecurity/default/data/ui/nav/default.xml

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,30 @@
11
<nav color="#db3d44">
2-
<view name="flashtimeline" default='true' />
3-
<collection label="Dashboards">
4-
<view name="deepsecurity_antimalware_dashboard" />
5-
<view name="deepsecurity_firewall_dashboard" />
6-
<view name="deepsecurity_ips_dashboard" />
7-
<view name="deepsecurity_integritymonitoring_dashboard" />
8-
<view name="deepsecurity_loginspection_dashboard" />
2+
<view name="flashtimeline" default='true' />
3+
<collection label="Dashboards">
4+
<view name="deepsecurity_antimalware_dashboard" />
5+
<view name="deepsecurity_appcontrol_dashboard" />
6+
<view name="deepsecurity_firewall_dashboard" />
7+
<view name="deepsecurity_ips_dashboard" />
8+
<view name="deepsecurity_integritymonitoring_dashboard" />
9+
<view name="deepsecurity_loginspection_dashboard" />
910
<view name="deepsecurity_webreputation_dashboard" />
10-
</collection>
11-
<collection label="Saved Searches">
11+
</collection>
12+
<collection label="Saved Searches">
1213
<collection label="Security Events">
1314
<saved source="unclassified" match="Deep Security - High Severity Events"/>
1415
<saved source="unclassified" match="Deep Security - All Security Events" />
1516
<collection label="Module Events">
1617
<saved source="unclassified" match="Deep Security - Anti-Malware Events" />
18+
<saved source="unclassified" match="Deep Security - Application Control Events" />
1719
<saved source="unclassified" match="Deep Security - Firewall Events" />
18-
<saved source="unclassified" match="Deep Security - Intrusion Prevention Events" />
19-
<saved source="unclassified" match="Deep Security - Integrity Monitoring Events" />
20-
<saved source="unclassified" match="Deep Security - Log Inspection Events" />
21-
<saved source="unclassified" match="Deep Security - Web Reputation Events" />
20+
<saved source="unclassified" match="Deep Security - Intrusion Prevention Events" />
21+
<saved source="unclassified" match="Deep Security - Integrity Monitoring Events" />
22+
<saved source="unclassified" match="Deep Security - Log Inspection Events" />
23+
<saved source="unclassified" match="Deep Security - Web Reputation Events" />
2224
</collection>
23-
</collection>
25+
</collection>
2426
<collection label="System Events">
2527
<saved source="unclassified" match="Deep Security - System Events" />
2628
</collection>
27-
</collection>
29+
</collection>
2830
</nav>

‎TrendMicroDeepSecurity/default/data/ui/views/deepsecurity_antimalware_dashboard.xml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<label>Deep Security Anti-Malware Dashboard</label>
33
<fieldset submitButton="false">
44
<input type="time" token="timeframe">
5-
<label>Timeframe</label>
5+
<label>Time Frame</label>
66
<default>
77
<earliestTime>-24h@h</earliestTime>
88
<latestTime>now</latestTime>
@@ -13,7 +13,7 @@
1313
<panel>
1414
<chart>
1515
<title>Anti-Malware Event History</title>
16-
<searchString>sourcetype="deepsecurity-antimalware"| timechart count by act limit=10</searchString>
16+
<searchString>sourcetype=deepsecurity-antimalware | timechart count by act limit=10</searchString>
1717
<earliestTime>$timeframe.earliest$</earliestTime>
1818
<latestTime>$timeframe.latest$</latestTime>
1919
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
@@ -42,8 +42,8 @@
4242
<row>
4343
<panel>
4444
<table>
45-
<title>Anti-Malware Status (Computers)</title>
46-
<searchString>sourcetype="deepsecurity-antimalware"| top limit=5 dvchost | rename dvchost as "Computer Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
45+
<title>Anti-Malware Activity</title>
46+
<searchString>sourcetype=deepsecurity-antimalware | top limit=5 cef_rulename | rename cef_rulename as "Malware Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
4747
<earliestTime>$timeframe.earliest$</earliestTime>
4848
<latestTime>$timeframe.latest$</latestTime>
4949
<option name="wrap">true</option>
@@ -55,8 +55,8 @@
5555
</panel>
5656
<panel>
5757
<table>
58-
<title>Anti-Malware Status (Malware)</title>
59-
<searchString>sourcetype="deepsecurity-antimalware"| top limit=5 cef_rulename | rename cef_rulename as "Malware Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
58+
<title>Anti-Malware Computer Activity</title>
59+
<searchString>sourcetype=deepsecurity-antimalware | top limit=5 dvchost | rename dvchost as "Computer Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
6060
<earliestTime>$timeframe.earliest$</earliestTime>
6161
<latestTime>$timeframe.latest$</latestTime>
6262
<option name="wrap">true</option>

‎TrendMicroDeepSecurity/default/data/ui/views/deepsecurity_appcontrol_dashboard.xml

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<form>
2+
<label>Deep Security Application Control Dashboard</label>
3+
<fieldset submitButton="false">
4+
<input type="time" token="timeframe">
5+
<label>Time Frame</label>
6+
<default>
7+
<earliestTime>-24h@h</earliestTime>
8+
<latestTime>now</latestTime>
9+
</default>
10+
</input>
11+
</fieldset>
12+
<row>
13+
<panel>
14+
<chart>
15+
<title>Application Control Event History</title>
16+
<searchString>sourcetype=deepsecurity-app_control | timechart count by act limit=10</searchString>
17+
<earliestTime>$timeframe.earliest$</earliestTime>
18+
<latestTime>$timeframe.latest$</latestTime>
19+
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
20+
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
21+
<option name="charting.axisTitleX.text">Hour</option>
22+
<option name="charting.axisTitleX.visibility">visible</option>
23+
<option name="charting.axisTitleY.text">Events</option>
24+
<option name="charting.axisTitleY.visibility">visible</option>
25+
<option name="charting.axisTitleY2.visibility">visible</option>
26+
<option name="charting.axisX.scale">linear</option>
27+
<option name="charting.axisY.scale">linear</option>
28+
<option name="charting.axisY2.enabled">false</option>
29+
<option name="charting.axisY2.scale">inherit</option>
30+
<option name="charting.chart">column</option>
31+
<option name="charting.chart.nullValueMode">gaps</option>
32+
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
33+
<option name="charting.chart.stackMode">stacked</option>
34+
<option name="charting.chart.style">shiny</option>
35+
<option name="charting.drilldown">all</option>
36+
<option name="charting.layout.splitSeries">0</option>
37+
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
38+
<option name="charting.legend.placement">right</option>
39+
</chart>
40+
</panel>
41+
</row>
42+
<row>
43+
<panel>
44+
<table>
45+
<title>Application Control Activity</title>
46+
<searchString>sourcetype=deepsecurity-app_control | top limit=5 cef_rulename | rename cef_rulename as "Event Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
47+
<earliestTime>$timeframe.earliest$</earliestTime>
48+
<latestTime>$timeframe.latest$</latestTime>
49+
<option name="wrap">true</option>
50+
<option name="rowNumbers">false</option>
51+
<option name="dataOverlayMode">none</option>
52+
<option name="drilldown">cell</option>
53+
<option name="count">10</option>
54+
</table>
55+
</panel>
56+
<panel>
57+
<table>
58+
<title>Application Control Computer Activity</title>
59+
<searchString>sourcetype=deepsecurity-app_control | top limit=5 dvchost | rename dvchost as "Computer Name" count AS "Event Count" percent AS "Percent of Total"</searchString>
60+
<earliestTime>$timeframe.earliest$</earliestTime>
61+
<latestTime>$timeframe.latest$</latestTime>
62+
<option name="wrap">true</option>
63+
<option name="rowNumbers">false</option>
64+
<option name="dataOverlayMode">none</option>
65+
<option name="drilldown">cell</option>
66+
<option name="count">10</option>
67+
</table>
68+
</panel>
69+
</row>
70+
</form>

‎TrendMicroDeepSecurity/default/props.conf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ TRANSFORMS-system_events = deepsecurity-system_events
1010
TRANSFORMS-integrity_monitoring = deepsecurity-integrity_monitoring
1111
TRANSFORMS-log_inspection = deepsecurity-log_inspection
1212
TRANSFORMS-web_reputation = deepsecurity-web_reputation
13+
TRANSFORMS-app_control = deepsecurity-app_control
1314
KV_MODE = none
1415

1516
[deepsecurity-firewall]
@@ -77,3 +78,11 @@ pulldown_type = 1
7778
FIELDALIAS-Deep Security Web Reptuation Field Aliases = cef_vendor AS vendor cef_product AS product request AS url dvchost AS src act AS action cef_ruleid AS rule_id
7879
REPORT-cefevents = deepsecurity-cefheaders,deepsecurity-cefkeys,deepsecurity-cefcustom
7980
KV_MODE = none
81+
82+
[deepsecurity-app_control]
83+
NO_BINARY_CHECK = 1
84+
SHOULD_LINEMERGE = false
85+
pulldown_type = 1
86+
FIELDALIAS-Deep Security Application Control Aliases = cef_vendor AS vendor cef_product AS product dvchost AS src act AS action cef_ruleid AS rule_id
87+
REPORT-cefevents = deepsecurity-cefheaders,deepsecurity-cefkeys,deepsecurity-cefcustom
88+
KV_MODE = none

‎TrendMicroDeepSecurity/default/savedsearches.conf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,3 +79,12 @@ cron_schedule = 0 0 * * *
7979
description = All High and Critical severity events from Deep Security's modules
8080
dispatch.earliest_time = -1h
8181
search = sourcetype=deepsecurity* NOT deepsecurity-system_events cef_severity > 7
82+
83+
[Deep Security - Application Control Events]
84+
alert.suppress = 0
85+
alert.track = 0
86+
auto_summarize.dispatch.earliest_time = -1d@h
87+
cron_schedule = 0 0 * * *
88+
description = Events generated by Deep Security's Application Control module
89+
dispatch.earliest_time = -1h
90+
search = sourcetype=deepsecurity-app_control

‎TrendMicroDeepSecurity/default/transforms.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,11 @@ REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Agent\|([^|]*)\|(4[0-9][0-9][0-9]
4444
FORMAT = sourcetype::deepsecurity-antimalware
4545
DEST_KEY = MetaData:Sourcetype
4646

47+
[deepsecurity-app_control]
48+
REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Agent\|([^|]*)\|(6[0-9][0-9][0-9][0-9][0-9][0-9])\|
49+
FORMAT = sourcetype::deepsecurity-app_control
50+
DEST_KEY = MetaData:Sourcetype
51+
4752
[deepsecurity-system_events]
4853
REGEX = CEF:(\s)?(\d+)\|([^|]*)\|Deep Security Manager\|([^|]*)\|
4954
FORMAT = sourcetype::deepsecurity-system_events

‎TrendMicroDeepSecurity/static/Thumbs.db

-14 KB
Binary file not shown.

0 commit comments

Comments
 (0)