Dashboards & Visualizations

Custom Real-Time Threat Map

jillian_caglios
Explorer

I want to create a custom real-time threat map similar to FireEye's - https://www.fireeye.com/cyber-map/threat-map.html or Norse's - http://map.ipviking.com using the data in Splunk. I have some very simple .js code that uses the Google Maps API and random data to create a similar map. However, I can’t seem to figure out how to run the .js code within Splunk. Furthermore, I can’t use the data from Splunk to populate the map. I would appreciate any suggestions or tips on how to do this in the simplest way possible.

LukeMurphey
Champion

I don't understand this: "I can’t use the data from Splunk to populate the map". Are you saying the data isn't in Splunk?

0 Karma

jillian_caglios
Explorer

The data is in Splunk and I can find it via the search feature. However, I can't figure out to get the custom code into Splunk, or how to get the search results into the code. Does this clarify things for you?

0 Karma

LukeMurphey
Champion

Splunk has a map built-in that you can use in simpleXML. You can use the geostats command with it to generate the stats in geographical bins and then hand the results to the map for rendering.

jillian_caglios
Explorer

LukeMurphey, Thanks you for the reply. I'm aware of this feature, but it doesn't meet our business need. We need to have lines animated from src to dst based on the geostats results. There are 4 types of unrelated lines that will have corresponding colors.

Splunk maps only allows for markers on one location, and it cannot handle the 4 different search results. It can only present the different search results as a pie chart, which would have little meaning. Because of this, I think I am going to have write some custom code to complete the job. If I could just figure out how to run javascript code in Splunk.

0 Karma

bk028s
Path Finder

Hi Jillian,

I'm actually working on a very similar problem right now and was wondering if you ever found a solution to your issue?

0 Karma

pmloikju
Explorer

Hi,

Have you achieve your projet ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...