Building Incident Response Dashboard

Building Incident Response Dashboard

When to Use

Use this skill when:

• IR teams need real-time dashboards during active incidents for coordination and tracking
• SOC leadership requires operational dashboards showing incident status and analyst workload
• Post-incident reviews need visual timelines and impact assessments
• Executive briefings require high-level incident metrics and trend analysis

Do not use for day-to-day SOC monitoring dashboards (use Incident Review instead) — IR dashboards are designed for active incident coordination and management reporting.

Prerequisites

• SIEM platform (Splunk with Dashboard Studio, Elastic Kibana, or Grafana)
• Notable event and incident data in SIEM (Splunk ES incident_review index)
• Ticketing system integration (ServiceNow, Jira) for remediation tracking
• Asset and identity lookup tables for context enrichment
• Dashboard publishing access for SOC team and management distribution

Workflow

Step 1: Design Active Incident Dashboard Layout

Build a Splunk Dashboard Studio dashboard for active incident tracking:

<dashboard version="2" theme="dark">
  <label>Active Incident Response Dashboard</label>
  <description>Real-time tracking for IR-2024-0450</description>

  <row>
    <panel>
      <title>Incident Summary</title>
      <single>
        <search>
          <query>
| makeresults
| eval incident_id="IR-2024-0450",
       status="CONTAINMENT",
       severity="Critical",
       affected_hosts=7,
       contained_hosts=5,
       iocs_identified=23,
       hours_elapsed=round((now()-strptime("2024-03-15 14:00","%Y-%m-%d %H:%M"))/3600,1)
| table incident_id, status, severity, affected_hosts, contained_hosts, iocs_identified, hours_elapsed
          </query>
        </search>
      </single>
    </panel>
  </row>
</dashboard>

Step 2: Build Real-Time Affected Systems Panel

Track affected systems and their containment status:

| inputlookup ir_affected_systems.csv
| eval status_color = case(
    status="Contained", "#2ecc71",
    status="Compromised", "#e74c3c",
    status="Investigating", "#f39c12",
    status="Recovered", "#3498db",
    1=1, "#95a5a6"
  )
| stats count by status
| eval order = case(status="Compromised", 1, status="Investigating", 2,
                    status="Contained", 3, status="Recovered", 4)
| sort order
| table status, count

--- Detailed host table
| inputlookup ir_affected_systems.csv
| lookup asset_lookup_by_cidr ip AS host_ip OUTPUT category, owner, priority
| table hostname, host_ip, category, owner, status, containment_time,
        compromise_vector, analyst_assigned
| sort status, hostname

Step 3: Build IOC Tracking Panel

Monitor IOC spread across the environment:

--- IOCs identified during incident
index=* (src_ip IN ("185.234.218.50", "45.77.123.45") OR
         dest IN ("evil-c2.com", "malware-drop.com") OR
         file_hash IN ("a1b2c3d4...", "e5f6a7b8..."))
earliest="2024-03-14"
| stats count AS hits, dc(src_ip) AS unique_sources,
        dc(dest) AS unique_dests, latest(_time) AS last_seen
  by sourcetype
| sort - hits

--- IOC timeline
index=* (src_ip IN ("185.234.218.50") OR dest="evil-c2.com")
earliest="2024-03-14"
| timechart span=1h count by sourcetype

--- New IOC discovery tracking
| inputlookup ir_ioc_list.csv
| stats count by ioc_type, source, discovery_time
| sort discovery_time
| table discovery_time, ioc_type, ioc_value, source, status

Step 4: Build Response Timeline Panel

Create chronological incident timeline:

| inputlookup ir_timeline.csv
| sort _time
| eval phase = case(
    action_type="detection", "Detection",
    action_type="triage", "Triage",
    action_type="containment", "Containment",
    action_type="eradication", "Eradication",
    action_type="recovery", "Recovery",
    1=1, "Other"
  )
| eval phase_color = case(
    phase="Detection", "#e74c3c",
    phase="Triage", "#f39c12",
    phase="Containment", "#e67e22",
    phase="Eradication", "#2ecc71",
    phase="Recovery", "#3498db"
  )
| table _time, phase, action, analyst, details

Example timeline data:

_time,action_type,action,analyst,details
2024-03-15 14:00,detection,Alert triggered - Cobalt Strike beacon detected,splunk_es,Notable event NE-2024-08921
2024-03-15 14:12,triage,Alert triaged - confirmed true positive,analyst_jdoe,VT score 52/72 on beacon hash
2024-03-15 14:23,containment,Host WORKSTATION-042 isolated,analyst_jdoe,CrowdStrike network isolation
2024-03-15 14:35,containment,C2 domain blocked on firewall,analyst_msmith,Palo Alto rule deployed
2024-03-15 15:00,eradication,Enterprise-wide IOC scan initiated,analyst_jdoe,Splunk search across all indices
2024-03-15 15:30,containment,3 additional hosts identified and isolated,analyst_msmith,Lateral movement confirmed
2024-03-15 16:00,eradication,Malware removed from all affected hosts,analyst_tier3,CrowdStrike RTR cleanup
2024-03-15 18:00,recovery,Systems restored and monitored,analyst_msmith,72-hour monitoring period started

Step 5: Build SOC Operations Dashboard

Track overall SOC performance metrics:

--- Incident volume by severity (last 30 days)
index=notable earliest=-30d
| stats count by urgency
| eval order = case(urgency="critical", 1, urgency="high", 2, urgency="medium", 3,
                    urgency="low", 4, urgency="informational", 5)
| sort order

--- MTTD (Mean Time to Detect)
index=notable earliest=-30d status_label="Resolved*"
| eval mttd_minutes = round((time_of_first_event - orig_time) / 60, 1)
| stats avg(mttd_minutes) AS avg_mttd, median(mttd_minutes) AS med_mttd,
        perc95(mttd_minutes) AS p95_mttd

--- MTTR (Mean Time to Respond/Resolve)
index=notable earliest=-30d status_label="Resolved*"
| eval mttr_hours = round((status_end - _time) / 3600, 1)
| stats avg(mttr_hours) AS avg_mttr, median(mttr_hours) AS med_mttr by urgency

--- Analyst workload distribution
index=notable earliest=-7d
| stats count by owner
| sort - count

--- Alert disposition breakdown
index=notable earliest=-30d status_label IN ("Resolved*", "Closed*")
| stats count by disposition
| eval percentage = round(count / sum(count) * 100, 1)
| sort - count

Step 6: Build Executive Briefing Dashboard

Create a high-level dashboard for leadership during major incidents:

--- Executive summary panel
| makeresults
| eval metrics = "Business Impact: 1 file server offline (Finance dept), "
                ."Estimated Recovery: 4 hours, "
                ."Data Loss Risk: Low (backups verified), "
                ."Customer Impact: None, "
                ."Regulatory Notification: Not required (no PII exposure confirmed)"

--- Trend comparison (this month vs last month)
index=notable earliest=-60d
| eval period = if(_time > relative_time(now(), "-30d"), "Current Month", "Previous Month")
| stats count by period, urgency
| chart sum(count) AS incidents by period, urgency

--- Top threat categories
index=notable earliest=-30d
| top rule_name limit=10
| table rule_name, count, percent

Step 7: Automate Dashboard Updates

Use Splunk scheduled searches to maintain dashboard data:

--- Scheduled search to update affected systems lookup (runs every 5 minutes)
index=* (src_ip IN [| inputlookup ir_ioc_list.csv | search ioc_type="ip"
                    | fields ioc_value | rename ioc_value AS src_ip])
earliest=-1h
| stats latest(_time) AS last_seen, count AS event_count,
        values(sourcetype) AS data_sources by src_ip
| eval status = if(last_seen > relative_time(now(), "-15m"), "Active", "Dormant")
| outputlookup ir_affected_systems_auto.csv

Key Concepts

Tools & Systems

• Splunk Dashboard Studio: Modern dashboard framework with drag-and-drop visualization and real-time data
• Elastic Kibana Dashboard: Visualization platform with Lens, Maps, and Canvas for security dashboards
• Grafana: Open-source visualization platform supporting multiple data sources including Elasticsearch and Splunk
• Microsoft Sentinel Workbooks: Azure-native dashboard framework with Kusto-based analytics visualization
• TheHive: Open-source incident response platform with built-in case tracking and metrics dashboards

Common Scenarios

• Active Ransomware Incident: Dashboard showing encryption spread, containment status, backup verification, recovery progress
• Data Breach Investigation: Dashboard tracking affected data stores, exfiltration volume, notification requirements
• Phishing Campaign Response: Dashboard showing recipient count, click rate, credential exposure, remediation status
• Monthly SOC Report: Leadership dashboard with incident trends, MTTD/MTTR metrics, analyst performance
• Compliance Audit: Dashboard demonstrating detection coverage, response SLA compliance, and incident closure metrics

Output Format

INCIDENT RESPONSE DASHBOARD — IR-2024-0450
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

STATUS: CONTAINMENT PHASE (6h 30m elapsed)

Affected Systems:          Containment Progress:
  Compromised:   2         [==========----------] 71%
  Investigating: 1         5 of 7 systems contained
  Contained:     3
  Recovered:     1

IOC Summary:               Response Timeline:
  IPs:      4              14:00 — Alert triggered
  Domains:  2              14:12 — Confirmed malicious
  Hashes:   3              14:23 — First host isolated
  URLs:     5              15:00 — Enterprise scan started
  Emails:   1              15:30 — 3 more hosts isolated

Key Metrics:
  MTTD:    12 minutes
  MTTC:    23 minutes (first host)
  Analysts Active: 3 (Tier 2: 2, Tier 3: 1)

Business Impact: LOW — Finance file server offline, no customer-facing systems affected

API Reference: Building Incident Response Dashboard

splunk-sdk (splunklib)

import splunklib.client as client
import splunklib.results as results

service = client.connect(host="localhost", port=8089,
                         username="admin", password="changeme")

# Run a blocking search
job = service.jobs.create(
    'search index=notable | stats count by urgency',
    earliest_time="-24h", latest_time="now", exec_mode="blocking"
)
for result in results.JSONResultsReader(job.results(output_mode="json")):
    print(result)

# Create a saved search (dashboard panel)
service.saved_searches.create("IR_Affected_Systems", search="""
    search index=notable incident_id="IR-*"
    | stats count by dest, urgency | sort - count
""")

Key SPL Patterns for IR Dashboards

--- Incident summary single-value panels
| makeresults | eval status="CONTAINMENT", affected=7, contained=5

--- SOC Metrics (MTTD / MTTR)
index=notable status_label="Resolved*"
| eval mttr_hours = round((status_end - _time) / 3600, 1)
| stats avg(mttr_hours) AS avg_mttr by urgency

--- Analyst workload
index=notable earliest=-7d | stats count by owner | sort - count

--- IOC spread tracking
index=* (src_ip IN ("1.2.3.4") OR dest="evil.com")
| timechart span=1h count by sourcetype

--- Alert disposition
index=notable status_label="Closed*"
| stats count by disposition
| eventstats sum(count) AS total
| eval pct = round(count/total*100, 1)

Dashboard Studio (Splunk v2)

<dashboard version="2" theme="dark">
  <label>IR Dashboard</label>
  <row>
    <panel><title>Affected Systems</title>
      <table><search><query>| inputlookup ir_systems.csv</query></search></table>
    </panel>
  </row>
</dashboard>

TheHive API (Case Tracking)

import requests
headers = {"Authorization": "Bearer <api_key>"}
# List open cases
resp = requests.get("http://thehive:9000/api/case",
    headers=headers, params={"range": "0-50", "sort": "-startDate"})

References

• splunk-sdk-python: https://github.com/splunk/splunk-sdk-python
• Splunk Dashboard Studio: https://docs.splunk.com/Documentation/DashboardStudio
• TheHive API: https://docs.strangebee.com/thehive/api-docs/

Construcción de un Dashboard de Respuesta a Incidentes

Cuándo Utilizar

Utilice esta habilidad cuando:

• Los equipos de IR necesitan dashboards en tiempo real durante incidentes activos para coordinación y seguimiento
• La dirección del SOC requiere dashboards operacionales que muestren el estado de incidentes y la carga de trabajo de los analistas
• Las revisiones post-incidente necesitan líneas de tiempo visuales y evaluaciones de impacto
• Las sesiones informativas ejecutivas requieren métricas de incidentes de alto nivel y análisis de tendencias

No utilizar para dashboards de monitoreo diario del SOC (use Incident Review en su lugar) — los dashboards de IR están diseñados para la coordinación de incidentes activos e informes de gestión.

Requisitos Previos

• Plataforma SIEM (Splunk con Dashboard Studio, Elastic Kibana o Grafana)
• Datos de eventos notables e incidentes en el SIEM (índice incident_review de Splunk ES)
• Integración con sistema de tickets (ServiceNow, Jira) para seguimiento de remediación
• Tablas de búsqueda de activos e identidades para enriquecimiento de contexto
• Acceso de publicación de dashboards para el equipo SOC y distribución a la gerencia

Flujo de Trabajo

Paso 1: Diseñar el Layout del Dashboard de Incidente Activo

Construir un dashboard en Splunk Dashboard Studio para seguimiento de incidentes activos:

<dashboard version="2" theme="dark">
  <label>Active Incident Response Dashboard</label>
  <description>Real-time tracking for IR-2024-0450</description>

  <row>
    <panel>
      <title>Incident Summary</title>
      <single>
        <search>
          <query>
| makeresults
| eval incident_id="IR-2024-0450",
       status="CONTAINMENT",
       severity="Critical",
       affected_hosts=7,
       contained_hosts=5,
       iocs_identified=23,
       hours_elapsed=round((now()-strptime("2024-03-15 14:00","%Y-%m-%d %H:%M"))/3600,1)
| table incident_id, status, severity, affected_hosts, contained_hosts, iocs_identified, hours_elapsed
          </query>
        </search>
      </single>
    </panel>
  </row>
</dashboard>

Paso 2: Construir el Panel de Sistemas Afectados en Tiempo Real

Rastrear sistemas afectados y su estado de contención:

| inputlookup ir_affected_systems.csv
| eval status_color = case(
    status="Contained", "#2ecc71",
    status="Compromised", "#e74c3c",
    status="Investigating", "#f39c12",
    status="Recovered", "#3498db",
    1=1, "#95a5a6"
  )
| stats count by status
| eval order = case(status="Compromised", 1, status="Investigating", 2,
                    status="Contained", 3, status="Recovered", 4)
| sort order
| table status, count

--- Tabla detallada de hosts
| inputlookup ir_affected_systems.csv
| lookup asset_lookup_by_cidr ip AS host_ip OUTPUT category, owner, priority
| table hostname, host_ip, category, owner, status, containment_time,
        compromise_vector, analyst_assigned
| sort status, hostname

Paso 3: Construir el Panel de Seguimiento de IOCs

Monitorear la propagación de IOCs en el entorno:

--- IOCs identificados durante el incidente
index=* (src_ip IN ("185.234.218.50", "45.77.123.45") OR
         dest IN ("evil-c2.com", "malware-drop.com") OR
         file_hash IN ("a1b2c3d4...", "e5f6a7b8..."))
earliest="2024-03-14"
| stats count AS hits, dc(src_ip) AS unique_sources,
        dc(dest) AS unique_dests, latest(_time) AS last_seen
  by sourcetype
| sort - hits

--- Línea de tiempo de IOCs
index=* (src_ip IN ("185.234.218.50") OR dest="evil-c2.com")
earliest="2024-03-14"
| timechart span=1h count by sourcetype

--- Seguimiento de descubrimiento de nuevos IOCs
| inputlookup ir_ioc_list.csv
| stats count by ioc_type, source, discovery_time
| sort discovery_time
| table discovery_time, ioc_type, ioc_value, source, status

Paso 4: Construir el Panel de Línea de Tiempo de Respuesta

Crear una línea de tiempo cronológica del incidente:

| inputlookup ir_timeline.csv
| sort _time
| eval phase = case(
    action_type="detection", "Detección",
    action_type="triage", "Triaje",
    action_type="containment", "Contención",
    action_type="eradication", "Erradicación",
    action_type="recovery", "Recuperación",
    1=1, "Otro"
  )
| eval phase_color = case(
    phase="Detección", "#e74c3c",
    phase="Triaje", "#f39c12",
    phase="Contención", "#e67e22",
    phase="Erradicación", "#2ecc71",
    phase="Recuperación", "#3498db"
  )
| table _time, phase, action, analyst, details

Ejemplo de datos de línea de tiempo:

_time,action_type,action,analyst,details
2024-03-15 14:00,detection,Alerta activada - Beacon de Cobalt Strike detectado,splunk_es,Evento notable NE-2024-08921
2024-03-15 14:12,triage,Alerta triada - verdadero positivo confirmado,analyst_jdoe,Puntuación VT 52/72 en hash del beacon
2024-03-15 14:23,containment,Host WORKSTATION-042 aislado,analyst_jdoe,Aislamiento de red con CrowdStrike
2024-03-15 14:35,containment,Dominio C2 bloqueado en firewall,analyst_msmith,Regla desplegada en Palo Alto
2024-03-15 15:00,eradication,Escaneo de IOCs a nivel empresarial iniciado,analyst_jdoe,Búsqueda en Splunk en todos los índices
2024-03-15 15:30,containment,3 hosts adicionales identificados y aislados,analyst_msmith,Movimiento lateral confirmado
2024-03-15 16:00,eradication,Malware eliminado de todos los hosts afectados,analyst_tier3,Limpieza con CrowdStrike RTR
2024-03-15 18:00,recovery,Sistemas restaurados y en monitoreo,analyst_msmith,Período de monitoreo de 72 horas iniciado

Paso 5: Construir el Dashboard de Operaciones del SOC

Rastrear las métricas generales de rendimiento del SOC:

--- Volumen de incidentes por severidad (últimos 30 días)
index=notable earliest=-30d
| stats count by urgency
| eval order = case(urgency="critical", 1, urgency="high", 2, urgency="medium", 3,
                    urgency="low", 4, urgency="informational", 5)
| sort order

--- MTTD (Tiempo Medio de Detección)
index=notable earliest=-30d status_label="Resolved*"
| eval mttd_minutes = round((time_of_first_event - orig_time) / 60, 1)
| stats avg(mttd_minutes) AS avg_mttd, median(mttd_minutes) AS med_mttd,
        perc95(mttd_minutes) AS p95_mttd

--- MTTR (Tiempo Medio de Respuesta/Resolución)
index=notable earliest=-30d status_label="Resolved*"
| eval mttr_hours = round((status_end - _time) / 3600, 1)
| stats avg(mttr_hours) AS avg_mttr, median(mttr_hours) AS med_mttr by urgency

--- Distribución de carga de trabajo por analista
index=notable earliest=-7d
| stats count by owner
| sort - count

--- Desglose de disposición de alertas
index=notable earliest=-30d status_label IN ("Resolved*", "Closed*")
| stats count by disposition
| eval percentage = round(count / sum(count) * 100, 1)
| sort - count

Paso 6: Construir el Dashboard de Sesión Informativa Ejecutiva

Crear un dashboard de alto nivel para la dirección durante incidentes mayores:

--- Panel de resumen ejecutivo
| makeresults
| eval metrics = "Impacto de Negocio: 1 servidor de archivos fuera de línea (depto. Finanzas), "
                ."Recuperación Estimada: 4 horas, "
                ."Riesgo de Pérdida de Datos: Bajo (respaldos verificados), "
                ."Impacto al Cliente: Ninguno, "
                ."Notificación Regulatoria: No requerida (sin exposición de PII confirmada)"

--- Comparación de tendencias (mes actual vs mes anterior)
index=notable earliest=-60d
| eval period = if(_time > relative_time(now(), "-30d"), "Mes Actual", "Mes Anterior")
| stats count by period, urgency
| chart sum(count) AS incidents by period, urgency

--- Principales categorías de amenazas
index=notable earliest=-30d
| top rule_name limit=10
| table rule_name, count, percent

Paso 7: Automatizar las Actualizaciones del Dashboard

Usar búsquedas programadas de Splunk para mantener los datos del dashboard:

--- Búsqueda programada para actualizar la tabla de sistemas afectados (se ejecuta cada 5 minutos)
index=* (src_ip IN [| inputlookup ir_ioc_list.csv | search ioc_type="ip"
                    | fields ioc_value | rename ioc_value AS src_ip])
earliest=-1h
| stats latest(_time) AS last_seen, count AS event_count,
        values(sourcetype) AS data_sources by src_ip
| eval status = if(last_seen > relative_time(now(), "-15m"), "Activo", "Inactivo")
| outputlookup ir_affected_systems_auto.csv

Conceptos Clave

Herramientas y Sistemas

• Splunk Dashboard Studio: Framework moderno de dashboards con visualización de arrastrar y soltar y datos en tiempo real
• Elastic Kibana Dashboard: Plataforma de visualización con Lens, Maps y Canvas para dashboards de seguridad
• Grafana: Plataforma de visualización de código abierto que soporta múltiples fuentes de datos incluyendo Elasticsearch y Splunk
• Microsoft Sentinel Workbooks: Framework de dashboards nativo de Azure con visualización de analíticas basadas en Kusto
• TheHive: Plataforma de respuesta a incidentes de código abierto con seguimiento de casos integrado y dashboards de métricas

Escenarios Comunes

• Incidente de Ransomware Activo: Dashboard que muestra la propagación del cifrado, estado de contención, verificación de respaldos, progreso de recuperación
• Investigación de Brecha de Datos: Dashboard que rastrea almacenes de datos afectados, volumen de exfiltración, requisitos de notificación
• Respuesta a Campaña de Phishing: Dashboard que muestra el conteo de destinatarios, tasa de clics, exposición de credenciales, estado de remediación
• Informe Mensual del SOC: Dashboard para la dirección con tendencias de incidentes, métricas MTTD/MTTR, rendimiento de analistas
• Auditoría de Cumplimiento: Dashboard que demuestra cobertura de detección, cumplimiento de SLA de respuesta y métricas de cierre de incidentes

Formato de Salida

DASHBOARD DE RESPUESTA A INCIDENTES — IR-2024-0450
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

ESTADO: FASE DE CONTENCIÓN (6h 30m transcurridas)

Sistemas Afectados:         Progreso de Contención:
  Comprometidos:   2        [==========----------] 71%
  En Investigación: 1       5 de 7 sistemas contenidos
  Contenidos:      3
  Recuperados:     1

Resumen de IOCs:            Línea de Tiempo de Respuesta:
  IPs:      4               14:00 — Alerta activada
  Dominios: 2               14:12 — Confirmado como malicioso
  Hashes:   3               14:23 — Primer host aislado
  URLs:     5               15:00 — Escaneo empresarial iniciado
  Correos:  1               15:30 — 3 hosts más aislados

Métricas Clave:
  MTTD:    12 minutos
  MTTC:    23 minutos (primer host)
  Analistas Activos: 3 (Nivel 2: 2, Nivel 3: 1)

Impacto de Negocio: BAJO — Servidor de archivos de Finanzas fuera de línea, sin afectación a sistemas orientados al cliente