The Balabit PAA Splunk App consists of 3 dashboards providing distinct views: the overview dashboard, the user profile dashboard and the detailed session analytics dashboard.
• The overview dashboard’s purpose is to give a general, high level overview over the sessions recorded by Balabit PSM and analyzed by Balabit PAA. It contains aggregated counters of sessions, line charts showing trends, maximum score values over time, as well as a table showing sessions in the selected time period. It builds on data that is constantly being updated, in near real-time.
• The user profile dashboard shows the behavioral profile or baseline of individual users. It is fed by the balabit_profiles index, and shows various information, including:
• Name of user
• LDAP/Windows AD groups the user is a member of
• Login time probability distribution
• Hosts most frequently accessed
• Commands that have been most frequently issued by the user
• Window titles that have been most often observed in the user’s RDP sessions
• The detailed session analytics dashboard shows detailed information about a single selected session only, including not only general information about the session, but the aggregated risk score and individual algorithm scores as well.
Customers can customize Balabit PAA to their specific needs by fine-tuning the algorithms.
New icons for the application
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.