Friday, June 10, 2016

Splunk Dashboard for Crowdstike HIDS Events

As of yet, there is  no Crowdstrike Add-on for Splunk. Getting data from CrowdStrike into Splunk can be achieved by using the CrowdStrike Falcon Connector application available from CrowdStrike. This is a Linux application that can be installed on the Splunk forwarder, along with a custom developed TA application, which simply contains the inputs.conf to read the JSON output from the SIEM connector, and a props.conf to handle the date fields in the JSON output.
cs.falconhoseclient
Further details regarding the Falcon connector can be found here: https://www.crowdstrike.com/resources/falcon-connector/
Registered users can obtain the RPM package cs.falconhoseclient-1.0.32-1.el7.centos.x86_64.rpm

The RPM installs to /opt/crowdstrike/ by default and installs the following files:
Directory listing of /opt/crowdstrike/
/opt/crowdstrike/
/opt/crowdstrike/bin
/opt/crowdstrike/bin/cs.falconhoseclient.pid
/opt/crowdstrike/bin/stream_offsets
/opt/crowdstrike/bin/cs.falconhoseclient
/opt/crowdstrike/log
/opt/crowdstrike/etc
/opt/crowdstrike/etc/cs.falconhoseclient.cef.cfg
/opt/crowdstrike/etc/cs.falconhoseclient.cfg
/opt/crowdstrike/etc/cs.falconhoseclient.leef.cfg











The following fields need to be populated in the /opt/crowdstrike/etc/cs.falconhoseclient.cfg file:
api_key = <api key from CrowdStrike>
api_uuid = <api uuid from CrowdStrike>
http_proxy = <proxy_details>

The API key and UUID can be updated through the CrowdStrike Support portal, by a user with the relevant level of access.

The output from the program is in JSON format and goes to the /opt/crowdstrike/log directory, to a file called output, i.e. /opt/crowdstrike/log/output.

The program contains an init.d script for startup and shutdown, but it needs to be tweaked to run as splunk user or which ever username that Splunk typically runs in your environment. The objective is to ensure both the application and splunk are running under same user.

When the cs.falconhoseclient application is started, it will automatically write the last OffsetID to a file, so that it can start from that OffsetID when it next connects. The ID is the second part of the JSON string, the bit not in quotes. for example,
/opt/crowdstrike/bin/stream_offsets
{"0":6962}
The offset in the file can be manually manipulated prior to startup of the application, if required.
Crowdstrike_TA.

Typical inputs.conf can simply look like below,

[monitor:///opt/crowdstrike/log/output]
sourcetype = crowdstrike:firehose
index = crowdstrike
ignoreOlderThan = 7d

The props.conf file specifies an 'or' condition in the regex for the TIME_PREFIX, as there are two distinct types of events that come from CrowdStrike, and they have dissimilar timestamp fields. Authentication events contain the string UTCTimestamp before the timestamp and Detection events contain the string ProcessStartTime before the timestamp:
/opt/splunk/etc/apps/Crowdstrike_TA/local/props.conf
[crowdstrike:firehose]
INDEXED_EXTRACTIONS = json
TIME_PREFIX = "UTCTimestamp": |"ProcessStartTime":
TIME_FORMAT = %s
KV_MODE = none

?

  
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050
051
052
053
054
055
056
057
058
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083
084
085
086
087
088
089
090
091
092
093
094
095
096
097
098
099
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
<form stylesheet="dark_2.css">
  <label>CrowdStrike HIDS</label>
  <description>CrowdStrike HIDS Dashbaord</description>
  <fieldset submitButton="false">
    <input type="time" token="global_time" searchWhenChanged="true">
      <label>Select Time Window</label>
      <default>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title># of Suspicious Activity Detected</title>
        <search>
          <query>index=crowdstrike "event.DetectName"="*" | timechart count</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">all</option>
        <option name="count">10</option>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="unitPosition">after</option>
        <option name="trendInterval">-7d</option>
      </single>
    </panel>
    <panel>
      <single>
        <title># of Workstation Infected</title>
        <search>
          <query>index=crowdstrike "event.ComputerName"=* | timechart count</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="unitPosition">after</option>
        <option name="trendInterval">-24h</option>
      </single>
    </panel>
    <panel>
      <single>
        <title># of Suspicious files detected</title>
        <search>
          <query>index=crowdstrike "event.FileName"=* | timechart count</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="unitPosition">after</option>
        <option name="trendInterval">-24h</option>
      </single>
    </panel>
    <panel>
      <single>
        <title># of Users Infected</title>
        <search>
          <query>index=crowdstrike "event.UserName"=* | timechart count</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="unitPosition">after</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Chart by Suspicious Activity</title>
        <search>
          <query>index=crowdstrike "event.DetectName"="*" "event.FileName"=* | stats count by event.DetectName</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Chart by ComputerName</title>
        <search>
          <query>index=crowdstrike "event.ComputerName"="*"  | top 10 event.ComputerName</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Chart by FileName</title>
        <search>
          <query>index=crowdstrike "event.DetectName"="*" "event.FileName"=*  | top 10 event.FileName</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Chart by Severity</title>
        <search>
          <query>index=crowdstrike "event.SeverityName"="*"  | stats count by event.SeverityName</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <input type="dropdown" token="split" searchWhenChanged="true">
        <label>Split by:</label>
        <choice value="event.ComputerName">ComputerName</choice>
        <choice value="event.DetectName">DetectName</choice>
        <choice value="event.SeverityName">SeverityName</choice>
        <choice value="event.UserName">UserName</choice>
        <choice value="metadata.eventType">eventType</choice>
        <choice value="event.ExecutablesWritten{}.FileName">FileName</choice>
        <default>event.DetectName</default>
      </input>
      <chart>
        <title>Timeline of activities</title>
        <search>
          <query>index=crowdstrike "event.DetectName"="*" | timechart count by $split$</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <map>
        <title>Remote connections</title>
        <search>
          <query>index=saas* event.DetectName=* "event.NetworkAccesses{}.RemoteAddress"="*" | RENAME event.NetworkAccesses{}.RemoteAddress AS ip | iplocation ip | geostats count by ip</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="mapping.type">marker</option>
        <option name="mapping.choroplethLayer.colorBins">5</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.maximumColor">0xDB5800</option>
        <option name="mapping.choroplethLayer.minimumColor">0x2F25BA</option>
        <option name="mapping.choroplethLayer.neutralPoint">0</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.75</option>
        <option name="mapping.choroplethLayer.showBorder">1</option>
        <option name="mapping.data.maxClusters">100</option>
        <option name="mapping.map.center">(0,0.35)</option>
        <option name="mapping.map.panning">true</option>
        <option name="mapping.map.scrollZoom">false</option>
        <option name="mapping.map.zoom">1</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">10</option>
        <option name="mapping.markerLayer.markerOpacity">0.8</option>
        <option name="mapping.showTiles">1</option>
        <option name="mapping.tileLayer.maxZoom">19</option>
        <option name="mapping.tileLayer.minZoom">0</option>
        <option name="mapping.tileLayer.tileOpacity">1</option>
        <option name="drilldown">all</option>
        <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
      </map>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Table of  Events</title>
        <search>
          <query>index=saas* event.DetectName=* | table _time event.DetectName event.SeverityName event.ComputerName event.UserName event.FileName  event.FilePath event.MD5String event.CommandLine</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <input type="text" token="keyword1" searchWhenChanged="true">
        <label>Enter an keyword-1:</label>
        <default>Known Malware</default>
      </input>
      <event>
        <title>Keyword Search</title>
        <search>
          <query>index=crowdstrike $keyword1$</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>
 

  
<form stylesheet="dark_2.css">
  <label>CrowdStrike HIDS</label>
  <description>CrowdStrike HIDS Dashbaord</description>
  <fieldset submitButton="false">
    <input type="time" token="global_time" searchWhenChanged="true">
      <label>Select Time Window</label>
      <default>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title># of Suspicious Activity Detected</title>
        <search>
          <query>index=crowdstrike "event.DetectName"="*" | timechart count</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">all</option>
        <option name="count">10</option>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="unitPosition">after</option>
        <option name="trendInterval">-7d</option>
      </single>
    </panel>
    <panel>
      <single>
        <title># of Workstation Infected</title>
        <search>
          <query>index=crowdstrike "event.ComputerName"=* | timechart count</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="unitPosition">after</option>
        <option name="trendInterval">-24h</option>
      </single>
    </panel>
    <panel>
      <single>
        <title># of Suspicious files detected</title>
        <search>
          <query>index=crowdstrike "event.FileName"=* | timechart count</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="colorBy">trend</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="unitPosition">after</option>
        <option name="trendInterval">-24h</option>
      </single>
    </panel>
    <panel>
      <single>
        <title># of Users Infected</title>
        <search>
          <query>index=crowdstrike "event.UserName"=* | timechart count</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
        <option name="linkView">search</option>
        <option name="unitPosition">after</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Chart by Suspicious Activity</title>
        <search>
          <query>index=crowdstrike "event.DetectName"="*" "event.FileName"=* | stats count by event.DetectName</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Chart by ComputerName</title>
        <search>
          <query>index=crowdstrike "event.ComputerName"="*"  | top 10 event.ComputerName</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Chart by FileName</title>
        <search>
          <query>index=crowdstrike "event.DetectName"="*" "event.FileName"=*  | top 10 event.FileName</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Chart by Severity</title>
        <search>
          <query>index=crowdstrike "event.SeverityName"="*"  | stats count by event.SeverityName</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <input type="dropdown" token="split" searchWhenChanged="true">
        <label>Split by:</label>
        <choice value="event.ComputerName">ComputerName</choice>
        <choice value="event.DetectName">DetectName</choice>
        <choice value="event.SeverityName">SeverityName</choice>
        <choice value="event.UserName">UserName</choice>
        <choice value="metadata.eventType">eventType</choice>
        <choice value="event.ExecutablesWritten{}.FileName">FileName</choice>
        <default>event.DetectName</default>
      </input>
      <chart>
        <title>Timeline of activities</title>
        <search>
          <query>index=crowdstrike "event.DetectName"="*" | timechart count by $split$</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">area</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <map>
        <title>Remote connections</title>
        <search>
          <query>index=crowdstrike event.DetectName=* "event.NetworkAccesses{}.RemoteAddress"="*" | RENAME event.NetworkAccesses{}.RemoteAddress AS ip | iplocation ip | geostats count by ip</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="mapping.type">marker</option>
        <option name="mapping.choroplethLayer.colorBins">5</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.maximumColor">0xDB5800</option>
        <option name="mapping.choroplethLayer.minimumColor">0x2F25BA</option>
        <option name="mapping.choroplethLayer.neutralPoint">0</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.75</option>
        <option name="mapping.choroplethLayer.showBorder">1</option>
        <option name="mapping.data.maxClusters">100</option>
        <option name="mapping.map.center">(0,0.35)</option>
        <option name="mapping.map.panning">true</option>
        <option name="mapping.map.scrollZoom">false</option>
        <option name="mapping.map.zoom">1</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">10</option>
        <option name="mapping.markerLayer.markerOpacity">0.8</option>
        <option name="mapping.showTiles">1</option>
        <option name="mapping.tileLayer.maxZoom">19</option>
        <option name="mapping.tileLayer.minZoom">0</option>
        <option name="mapping.tileLayer.tileOpacity">1</option>
        <option name="drilldown">all</option>
        <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
      </map>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Table of  Events</title>
        <search>
          <query>index=crowdstrike event.DetectName=* | table _time event.DetectName event.SeverityName event.ComputerName event.UserName event.FileName  event.FilePath event.MD5String event.CommandLine</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <input type="text" token="keyword1" searchWhenChanged="true">
        <label>Enter an keyword-1:</label>
        <default>Known Malware</default>
      </input>
      <event>
        <title>Keyword Search</title>
        <search>
          <query>index=crowdstrike $keyword1$</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>