29d (edited) • General Discussion 💬
Linux Network Telemetry Dashboard
Was about to start port scanning exercises when I realized — might
as well watch the scans land somewhere useful.
Splunk doesn't auto-generate dashboards, so I had RIGGS knock out
the config: auditd syscall rules on the ThinkPad to log every
network connection at the kernel level, a monitor stanza in
Splunk's inputs.conf to pull the audit log in, and a quick group
permissions fix so Splunk could read a root-owned file. RIGGS
drafted the dashboard XML, I pasted it into Splunk's editor.
Structured the dashboard around the analyst workflow rather than
data type — Baseline (7-day normal), Detect (60-min anomaly view,
where scan spikes will show), Investigate (raw 15-min stream). The
idea: a junior analyst should be able to open it and know exactly
what question each panel is answering.
Need a few days of normal traffic before the baseline means
anything. But the pipeline is live and the next scan I run hits
those detect panels in real time.
5
0 comments
Linux Network Telemetry Dashboard
skool.com/ai-automation-society
Learn to get paid for AI solutions, regardless of your background.
Leaderboard (30-day)
1
🔥
+7905
2
+6680
3
🔥
+5906
4
🔥
+5761
5
🔥
+2146
Powered by