Skip to content

Add OCSF based dashboards and Observo Lua script - #8

Open
prashant-nakum91 wants to merge 1 commit into
mainfrom
feature/observo-lua-and-ocsf-dashboards
Open

prashant-nakum91 wants to merge 1 commit into
mainfrom
feature/observo-lua-and-ocsf-dashboards

Conversation

@prashant-nakum91

Copy link
Copy Markdown
Collaborator

Below are the changes done in this PR:

  • Added the Lua script for the Observo pipeline.
  • Created 4 new dashboards with all the panels and filters: Anomaly Detection Insights, Anomaly Detection Details, AI Detection and Response, and Network Performance Anomalies. For each of these, we have created two versions: a native parser based dashboard using raw log fields, and an Observo OCSF based dashboard.
  • For the existing dashboards, replaced the raw log fields with OCSF fields and created OCSF based versions of them.
  • Added native parsers with common fields for the newly added log types.

Folder structure:
dashboards/observo-ocsf/: Latest and recommended dashboards based on Observo OCSF fields.
dashboards/native-legacy/: Older dashboards based on SentinelOne native parsers.
observo-lua-scripts/: Lua scripts for the Observo pipeline.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant