The Malwarebytes Visibility and Dashboards app provides custom Splunk searches and dashboards for Malwarebytes endpoint data. This app provides a visual experience for Malwarebytes users. Dashboards have been optimized for fast performance and contain custom drill-downs.
Requirements
To run the Malwarebytes Visibility and Dashboards app, you need:
- An active Splunk Enterprise or Splunk Cloud instance.
- User login credentials for Splunk.
- An active Malwarebytes Nebula subscription for either Endpoint Protection or Incident Response
- Malwarebytes Nebula platform login credentials.
- Technical Add-on for Malwarebytes installed. Refer to Install the Technical Add-on for Malwarebytes for Splunk for more information.
Download Malwarebytes Visibility and Dashboards app
To download the Malwarebytes Visibility and Dashboards app:
- Go to the Malwarebytes Visibility and Dashboards page in Splunkbase.
-
Click on LOGIN TO DOWNLOAD. If already logged into Splunkbase, click on DOWNLOAD.
-
Enter your Splunk user credentials.
Install Malwarebytes Visibility and Dashboards app
Where you install the Malwarebytes app is based on your Splunk environment.
Splunk Enterprise Single Instance Environments
Install the Malwarebytes Visibility and Dashboards app in the same location where the Splunk components, Search Tier, Indexer Tier, and Forwarder Tier are located. For instructions on installing add-on in a single instance environments, refer to Splunk's support article Install an add-on in a single-instance Splunk Enterprise deployment.
Splunk Enterprise Distributed Environments
Install the Malwarebytes Visibility and Dashboards app where your Search Tier is located. For instructions on installing an add-on in a distributed Splunk Enterprise environment, refer to Splunk's support article Install an add-on in a distributed Splunk Enterprise deployment.
Configure Malwarebytes Nebula platform
- Log into your Malwarebytes Nebula platform.
- Go to Settings > Syslog Logging > click Syslog Settings.
- In the Syslog Communication Settings menu:
- Set the IP Address/Host to match the Splunk syslog server IP/Domain to receive events into the Splunk server.
- In Protocol, set the TCP/UDP as the same as your Splunk server configuration.
- Click Save.
- You must designate an endpoint to forward data to Splunk. An endpoint with a stable internet connection, such as a server, is recommended. In Settings > Syslog Logging:
- Click Add.
- Click a checkbox next the endpoint you want to designate.
- Click Assign.
Configure Splunk Enterprise
To configure the data inputs for Malwarebytes Endpoint Protection or Incident Response, follow the steps below.
- Login to Splunk using administrator credentials and go to Settings > Data Inputs.
- Under Forwarded Inputs, select either TCP or UDP. Select New.
- Enter 514 in the Port field. Click Next.
- In the Input Settings screen:
- For Source type, click Select and choose Malware > choose mwb:cloud from the dropdown menu.
- For App context, select Add-on for Malwarebytes (TA-malwarebytes) from the dropdown menu.
- For Host > Method, select either IP or DNS.
- For Index, select malwarebytes from the dropdown menu. Click Review.
- In Review, make sure all of your configurations are correct, then select Submit to complete the data input configuration on the Splunk instance.
Splunk Enterprise dashboard examples
Overview dashboard
Endpoints dashboard
Detections dashboard
Configure Splunk Cloud
You must have Universal Forwarder installed to configure Splunk Cloud. Refer to the Splunk support document, Configure forwarding and receiving for Splunk Cloud for instructions.
To get the Malwarebytes data into Splunk Cloud, configure your forwarder to send syslog data to your Splunk Cloud instance.
Splunk Cloud dashboard examples
Overview dashboard
Endpoints dashboard
Detections dashboard
Quarantined dashboard
The events received by Splunk Cloud from Malwarebytes products display in CEF format. Go to App: Search & Reporting > Search & Reporting to view.
