inital commit. imported from SVN

plusserver · Jun 25, 2015 · 2066057 · 2066057
1 parent 7fc889b
commit 2066057
Show file tree

Hide file tree

Showing 17 changed files with 1,031 additions and 0 deletions.
diff --git a/README.txt b/README.txt
@@ -0,0 +1,65 @@
+F5 WAF Security for Splunk by Nexinto
+=====================================
+
+
+Overview
+--------
+The app "F5 WAF Security for Splunk by Nexinto" analyzes attacks on your web infrastructure prohibited by F5 ASM.
+
+Features:
+	-	Displays attacks based on GeoIP
+	-	Displays attacks based on Type
+	-	Displays attacks based on Violation, Signature
+	-	Displays attacks based on Country
+	-	Displays attacks based on IPs
+	-	Heatmap for Attack Type Distribution by Type, Country, Violation
+	-	Security Stats table for displaying chronological attack requests and locations
+
+Installation
+------------
+
+Deploy "F5 WAF Security for Splunk by Nexinto" like every other App by uploading  it using the WebGUI or extracting it to $SPLUNK_HOME$/etc/apps. 
+Restart Splunk afterwards.
+
+In a distributed environment the app has to be deployed to every Search head and Indexer. Make sure the app is also deployed on the Host or 
+Forwarder receiving the events from the F5 devices. 
+
+With default settings the app will create an index �f5_asm_live� and a TCP input on port 10005 using sourcetype syslog_f5asm. You can customize these 
+settings by changing the TCP port in inputs.conf.
+
+Creating a logging profile on F5 ASM for sending Events to Splunk
+------------------------------------------------------------------
+
+To integrate Splunk you will need to create a new logging profile on your F5 ASM which sends the events to your Splunk TCP input. 
+
+To create a logging profile:
+
+	1.	On the Main Tab select Security, expand Event Logs. The Edit Logging Profile page opens.
+	2.	Check �Application Security� in the Logging Profile Properties.
+	3.	At Application Security tab select �Advanced� for Configuration setting.
+	4.	Select the Remote Storage check box, and for the Type select Reporting Server.
+	5.	Set Response Logging to Off.
+	6.	For the protocol setting, select TCP.
+	7.	For the IP Address setting, type the name of the host providing the TCP input (forwarder or indexer)
+	8.	For the Port setting type the default value 10005.
+	9.	Within the Storage Filter tab choose Request type = �Illegal Requests Only�
+	10.	Click the �Update� Button.
+
+Feedback and Contact
+--------------------
+
+If you have Feedback, issues or questions please use issue tracker at Github page: http://github.com/blafasel  ;). 
+For direct Feedback please contact: splunkapps@nexinto.com. 
+
+This app was created by:
+
+Nexinto GmbH
+Nagelsweg 33-35
+20097 Hamburg
+
+Telefon: +49 40-77175-0
+Telefax: +49 40-77175-519
+
+E-Mail: ITSolutions@nexinto.com
+Internet: www.nexinto.com
+
diff --git a/appserver/static/asm_profile.png b/appserver/static/asm_profile.png
diff --git a/default/app.conf b/default/app.conf
@@ -0,0 +1,19 @@
+#
+# Splunk app configuration file
+#
+
+[install]
+is_configured = true
+state_change_requires_restart = true
+state = enabled
+build = 127
+
+[ui]
+is_visible = 1
+label = F5 WAF Security for Splunk
+
+[launcher]
+author = Nexinto GmbH 
+description = analyze your F5 ASM attacks
+version = 1.0
+
diff --git a/default/data/ui/nav/default.xml b/default/data/ui/nav/default.xml
@@ -0,0 +1,19 @@
+<nav search_view="search" color="#65A637">
+   <view name="f5_asm_live" />
+
+            <view name="asm_attack_types" default='true'/>
+            <view name="asm_attack_types_numbers" />
+      		<view name="security_stats" />
+
+  <view name="help" />
+  <view name="search" />
+
+
+<!--
+  <view name="search" default='true' />
+  <view name="data_models" />
+  <view name="reports" />
+  <view name="alerts" />
+  <view name="dashboards" />
+-->
+</nav>
diff --git a/default/data/ui/views/asm_attack_types.xml b/default/data/ui/views/asm_attack_types.xml
diff --git a/default/data/ui/views/asm_attack_types_numbers.xml b/default/data/ui/views/asm_attack_types_numbers.xml
@@ -0,0 +1,251 @@
+<form>
+  <label>Security Heatmaps</label>
+  <fieldset submitButton="false" autoRun="true">
+    <input type="time" searchWhenChanged="true">
+      <label>Select Time:</label>
+      <default>
+        <earliest>-4h@m</earliest>
+        <latest>now</latest>
+      </default>
+    </input>
+  </fieldset>
+  <row>
+    <panel>
+      <table>
+        <title>Attack Type Distribution by Type Over Time</title>
+        <search>
+          <query>index="f5_asm_live" sourcetype=syslog OR sourcetype=syslog_f5asm attack_type | timechart count by attack_type useother=no limit=10</query>
+        </search>
+        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
+        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
+        <option name="charting.axisTitleX.visibility">collapsed</option>
+        <option name="charting.axisTitleY.visibility">collapsed</option>
+        <option name="charting.axisTitleY2.visibility">visible</option>
+        <option name="charting.axisX.scale">linear</option>
+        <option name="charting.axisY.scale">linear</option>
+        <option name="charting.axisY2.enabled">false</option>
+        <option name="charting.axisY2.scale">inherit</option>
+        <option name="charting.chart">area</option>
+        <option name="charting.chart.nullValueMode">gaps</option>
+        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
+        <option name="charting.chart.stackMode">default</option>
+        <option name="charting.chart.style">shiny</option>
+        <option name="charting.drilldown">all</option>
+        <option name="charting.layout.splitSeries">0</option>
+        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
+        <option name="charting.legend.placement">bottom</option>
+        <option name="wrap">true</option>
+        <option name="rowNumbers">false</option>
+        <option name="dataOverlayMode">heatmap</option>
+        <option name="drilldown">cell</option>
+        <option name="count">10</option>
+      </table>
+    </panel>
+  </row>
+  <row>
+    <panel>
+      <table>
+        <title>Attack Distribution by Country Over Time</title>
+        <search>
+          <query>index="f5_asm_live" sourcetype=syslog OR sourcetype=syslog_f5asm geo_location | timechart count by geo_location useother=no limit=10</query>
+        </search>
+        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
+        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
+        <option name="charting.axisTitleX.visibility">collapsed</option>
+        <option name="charting.axisTitleY.visibility">collapsed</option>
+        <option name="charting.axisTitleY2.visibility">visible</option>
+        <option name="charting.axisX.scale">linear</option>
+        <option name="charting.axisY.scale">linear</option>
+        <option name="charting.axisY2.enabled">false</option>
+        <option name="charting.axisY2.scale">inherit</option>
+        <option name="charting.chart">area</option>
+        <option name="charting.chart.nullValueMode">gaps</option>
+        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
+        <option name="charting.chart.stackMode">default</option>
+        <option name="charting.chart.style">shiny</option>
+        <option name="charting.drilldown">all</option>
+        <option name="charting.layout.splitSeries">0</option>
+        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
+        <option name="charting.legend.placement">bottom</option>
+        <option name="wrap">true</option>
+        <option name="rowNumbers">false</option>
+        <option name="dataOverlayMode">heatmap</option>
+        <option name="drilldown">cell</option>
+        <option name="count">10</option>
+      </table>
+    </panel>
+  </row>
+  <row>
+    <panel>
+      <table>
+        <title>Top Attacking Types</title>
+        <search>
+          <query>index="f5_asm_live" sourcetype=syslog OR sourcetype=syslog_f5asm | top limit=10 attack_type useother=no</query>
+        </search>
+        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
+        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
+        <option name="charting.axisTitleX.visibility">collapsed</option>
+        <option name="charting.axisTitleY.visibility">collapsed</option>
+        <option name="charting.axisTitleY2.visibility">visible</option>
+        <option name="charting.axisX.scale">linear</option>
+        <option name="charting.axisY.scale">linear</option>
+        <option name="charting.axisY2.enabled">false</option>
+        <option name="charting.axisY2.scale">inherit</option>
+        <option name="charting.chart">bar</option>
+        <option name="charting.chart.nullValueMode">gaps</option>
+        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
+        <option name="charting.chart.stackMode">default</option>
+        <option name="charting.chart.style">shiny</option>
+        <option name="charting.drilldown">all</option>
+        <option name="charting.layout.splitSeries">0</option>
+        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
+        <option name="charting.legend.placement">none</option>
+        <option name="charting.axisTitleY.text">Events by Attack Type</option>
+        <option name="list.drilldown">full</option>
+        <option name="list.wrap">1</option>
+        <option name="maxLines">5</option>
+        <option name="raw.drilldown">full</option>
+        <option name="rowNumbers">false</option>
+        <option name="table.drilldown">all</option>
+        <option name="table.wrap">1</option>
+        <option name="type">list</option>
+        <option name="wrap">true</option>
+        <option name="dataOverlayMode">heatmap</option>
+        <option name="drilldown">cell</option>
+        <option name="count">10</option>
+      </table>
+    </panel>
+  </row>
+  <row>
+    <panel>
+      <table>
+        <title>Top Attacking by Violation</title>
+        <search>
+          <query>index="f5_asm_live" sourcetype=syslog OR sourcetype=syslog_f5asm violations | rex field=violations mode=sed "s/violations=//g"  | top violations limit=10 useother=no</query>
+        </search>
+        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
+        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
+        <option name="charting.axisTitleX.visibility">collapsed</option>
+        <option name="charting.axisTitleY.visibility">collapsed</option>
+        <option name="charting.axisTitleY2.visibility">visible</option>
+        <option name="charting.axisX.scale">linear</option>
+        <option name="charting.axisY.scale">linear</option>
+        <option name="charting.axisY2.enabled">false</option>
+        <option name="charting.axisY2.scale">inherit</option>
+        <option name="charting.chart">bar</option>
+        <option name="charting.chart.nullValueMode">gaps</option>
+        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
+        <option name="charting.chart.stackMode">default</option>
+        <option name="charting.chart.style">shiny</option>
+        <option name="charting.drilldown">all</option>
+        <option name="charting.layout.splitSeries">0</option>
+        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
+        <option name="charting.legend.placement">none</option>
+        <option name="wrap">true</option>
+        <option name="rowNumbers">false</option>
+        <option name="dataOverlayMode">heatmap</option>
+        <option name="drilldown">cell</option>
+        <option name="count">10</option>
+      </table>
+    </panel>
+  </row>
+  <row>
+    <panel>
+      <table>
+        <title>Top Attacking by Signature</title>
+        <search>
+          <query>index="f5_asm_live" sourcetype=syslog OR sourcetype=syslog_f5asm NOT sig_names="sig_names=\"\"" | rex field=sig_names mode=sed "s/sig_names=//g" | top sig_names limit=10 useother=no</query>
+        </search>
+        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
+        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
+        <option name="charting.axisTitleX.visibility">visible</option>
+        <option name="charting.axisTitleY.visibility">visible</option>
+        <option name="charting.axisTitleY2.visibility">visible</option>
+        <option name="charting.axisX.scale">linear</option>
+        <option name="charting.axisY.scale">linear</option>
+        <option name="charting.axisY2.enabled">false</option>
+        <option name="charting.axisY2.scale">inherit</option>
+        <option name="charting.chart">bar</option>
+        <option name="charting.chart.nullValueMode">gaps</option>
+        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
+        <option name="charting.chart.stackMode">default</option>
+        <option name="charting.chart.style">shiny</option>
+        <option name="charting.drilldown">all</option>
+        <option name="charting.layout.splitSeries">0</option>
+        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
+        <option name="charting.legend.placement">right</option>
+        <option name="wrap">true</option>
+        <option name="rowNumbers">false</option>
+        <option name="dataOverlayMode">heatmap</option>
+        <option name="drilldown">cell</option>
+        <option name="count">10</option>
+      </table>
+    </panel>
+  </row>
+  <row>
+    <panel>
+      <table>
+        <title>Top Attacking Countries</title>
+        <search>
+          <query>index="f5_asm_live" sourcetype=syslog OR sourcetype=syslog_f5asm | top geo_location limit=10</query>
+        </search>
+        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
+        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
+        <option name="charting.axisTitleX.visibility">collapsed</option>
+        <option name="charting.axisTitleY.visibility">collapsed</option>
+        <option name="charting.axisTitleY2.visibility">visible</option>
+        <option name="charting.axisX.scale">linear</option>
+        <option name="charting.axisY.scale">linear</option>
+        <option name="charting.axisY2.enabled">false</option>
+        <option name="charting.axisY2.scale">inherit</option>
+        <option name="charting.chart">bar</option>
+        <option name="charting.chart.nullValueMode">gaps</option>
+        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
+        <option name="charting.chart.stackMode">default</option>
+        <option name="charting.chart.style">shiny</option>
+        <option name="charting.drilldown">all</option>
+        <option name="charting.layout.splitSeries">0</option>
+        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
+        <option name="charting.legend.placement">none</option>
+        <option name="wrap">true</option>
+        <option name="rowNumbers">false</option>
+        <option name="dataOverlayMode">heatmap</option>
+        <option name="drilldown">cell</option>
+        <option name="count">10</option>
+      </table>
+    </panel>
+  </row>
+  <row>
+    <panel>
+      <table>
+        <title>Top Attacking IPs</title>
+        <search>
+          <query>index="f5_asm_live" sourcetype=syslog OR sourcetype=syslog_f5asm | top ip_client limit=10</query>
+        </search>
+        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
+        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
+        <option name="charting.axisTitleX.visibility">collapsed</option>
+        <option name="charting.axisTitleY.visibility">collapsed</option>
+        <option name="charting.axisTitleY2.visibility">visible</option>
+        <option name="charting.axisX.scale">linear</option>
+        <option name="charting.axisY.scale">linear</option>
+        <option name="charting.axisY2.enabled">false</option>
+        <option name="charting.axisY2.scale">inherit</option>
+        <option name="charting.chart">bar</option>
+        <option name="charting.chart.nullValueMode">gaps</option>
+        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
+        <option name="charting.chart.stackMode">default</option>
+        <option name="charting.chart.style">shiny</option>
+        <option name="charting.drilldown">all</option>
+        <option name="charting.layout.splitSeries">0</option>
+        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
+        <option name="charting.legend.placement">none</option>
+        <option name="wrap">true</option>
+        <option name="rowNumbers">false</option>
+        <option name="dataOverlayMode">heatmap</option>
+        <option name="drilldown">cell</option>
+        <option name="count">10</option>
+      </table>
+    </panel>
+  </row>
+</form>