Dashboards & Visualizations

Custom Real-Time Threat Map

jillian_caglios
Explorer

I want to create a custom real-time threat map similar to FireEye's - https://www.fireeye.com/cyber-map/threat-map.html or Norse's - http://map.ipviking.com using the data in Splunk. I have some very simple .js code that uses the Google Maps API and random data to create a similar map. However, I can’t seem to figure out how to run the .js code within Splunk. Furthermore, I can’t use the data from Splunk to populate the map. I would appreciate any suggestions or tips on how to do this in the simplest way possible.

LukeMurphey
Champion

I don't understand this: "I can’t use the data from Splunk to populate the map". Are you saying the data isn't in Splunk?

0 Karma

jillian_caglios
Explorer

The data is in Splunk and I can find it via the search feature. However, I can't figure out to get the custom code into Splunk, or how to get the search results into the code. Does this clarify things for you?

0 Karma

LukeMurphey
Champion

Splunk has a map built-in that you can use in simpleXML. You can use the geostats command with it to generate the stats in geographical bins and then hand the results to the map for rendering.

jillian_caglios
Explorer

LukeMurphey, Thanks you for the reply. I'm aware of this feature, but it doesn't meet our business need. We need to have lines animated from src to dst based on the geostats results. There are 4 types of unrelated lines that will have corresponding colors.

Splunk maps only allows for markers on one location, and it cannot handle the 4 different search results. It can only present the different search results as a pie chart, which would have little meaning. Because of this, I think I am going to have write some custom code to complete the job. If I could just figure out how to run javascript code in Splunk.

0 Karma

bk028s
Path Finder

Hi Jillian,

I'm actually working on a very similar problem right now and was wondering if you ever found a solution to your issue?

0 Karma

pmloikju
Explorer

Hi,

Have you achieve your projet ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...