splunk
Loki_app
Overview
Details
The application intented to visualize the results of Loki Scanner, It has 2 dashboard one overview and another for analyst or threat hunter to investigate the result.
Enjoy using and add more ideas to it.
Happy Splunking ^^
Enjoy using and add more ideas to it.
Happy Splunking ^^
For full document check this link: https://blue-v3n0m.blogspot.com/2022/05/automate-loki-using-splunk.html
This application depends on 3 addons, 2 of them are Custom Visualization. You have to install these addons on the search head that has Loki app installed on it:
1) TA_Loki -- https://splunkbase.splunk.com/app/6378/
2) Splunk Sankey Diagram -- https://splunkbase.splunk.com/app/3112/
3) Force Directed App For Splunk -- https://splunkbase.splunk.com/app/3767/
Only one setup is required, set the MACRO of loki_index to a specific index
Settings --> Advanced search --> Search Macros --> App (Loki_App) --> search for loki_index and set it to the index
Release Notes
Version 1.0.1
May 8, 2022
fixed some typo
Version 1.0.0
May 7, 2022
Version 1.0.0