Splunk Dashboards Reference

The TA ships with 5 dashboards focused on enrichment, investigation, and compliance. All dashboards use Splunk Dashboard Studio (JSON v2), which supports dark mode and Splunk Cloud.

All data-facing dashboards reference the whisper_index macro instead of a hardcoded index name. By default, this macro resolves to index=whisper. To use a different index, override the macro in Settings > Advanced Search > Search Macros or create a local/macros.conf override.

After installing the TA, navigate to Apps > Whisper Security TA. The navigation is organized around the three customer workflows:

• Investigation
  • Lookup / Investigation (default) -- Ad hoc domain/IP investigation with multiple read-only graph pivots
• Attack Surface
  • Attack Surface Change Timeline -- DNS infrastructure change timeline with risk scoring (driven by the owned-domain modular input)
• Compliance and Posture
  • Compliance Summary -- Executive compliance overview
  • SPF Compliance -- SPF authentication analysis
  • Mail Configuration -- MX record monitoring
• Search -- Ad hoc SPL search view
• Inputs -- Manage modular inputs (owned-domain monitoring, etc.)
• Configuration -- API key and account settings

Ad hoc domain and IP investigation using the Whisper Knowledge Graph. Enter an indicator and click Submit to run a set of read-only graph pivots in parallel. The dashboard does not write data, does not use collect, and does not generate risk events or alerts.

Panels (semantics corrected per #480):

Input: Indicator (domain or IP). Panels only run after Submit is clicked, so the dashboard makes no API calls on load.

Indicator validation: Each pivot panel passes $indicator_input$ directly to whisperquery as the indicator Cypher parameter and enables the server-side allowlist validator via validate_indicator="indicator". The command lowercases the value and gates it on the regex allowlist ^[A-Za-z0-9._:\-]+$; empty or malicious input short-circuits with zero events before any Cypher executes. The enrichment panel uses the equivalent inline SPL guard (| makeresults | eval indicator=lower("$indicator_input$") | where match(indicator, "^[A-Za-z0-9._:\-]+$") | whisperlookup field=indicator) because whisperlookup is a streaming command and can consume a pipeline. Cypher queries are parameterized ($indicator placeholder) rather than string-interpolated.

Example SPL matching what the dashboard runs:

| makeresults | eval indicator="example.com" | whisperlookup field=indicator

| whisperquery query="MATCH (h:HOSTNAME {name: $indicator})-[:RESOLVES_TO]->(ip:IPV4) RETURN h.name, ip.name LIMIT 10" params="indicator=example.com"

Shows SPF (Sender Policy Framework) configuration for your monitored domains.

Panels:

Filters: Time range, domain filter

Drill-down: Click a domain row to see its SPF include chain and authorized sending IPs.

Shows MX (Mail Exchange) record configuration and changes.

Panels:

Filters: Time range, domain filter

Shows the timeline of DNS infrastructure changes detected across your monitored domains, ranked by risk score and broken down by record type.

Panels:

Filters: Time range

Data dependency: This dashboard reads sourcetype=whisper:attack_surface_change events. The Attack Surface Baseline modular input emits these events on its second and subsequent runs (the first run only writes the baseline; change detection starts from the next run). If the dashboard is empty, verify that the baseline input is enabled and has run at least twice.

Compliance overview across all monitored domains, built for management reporting.

Panels:

Filters: Time range (default: 7 days)

The add-on ships a small set of disabled utility searches and example enrichment pipeline templates. It does not ship prebuilt correlation searches. Customers who want detections clone an example template, point it at their own source index and indicator field, and enable it. See Saved searches for the complete list and the customization parameters.

Tracks DNS infrastructure changes for your external-facing domains on a schedule.

DNS baseline collection

The Whisper DNS Baseline modular input collects:

• A records (IP resolution)
• Nameservers (authoritative NS)
• Mail servers (MX records)
• Subdomains
• CNAME chains

Events are written with sourcetype=whisper:attack_surface.

Configuration

1. Navigate to Apps > Whisper Security TA > Inputs
2. Create a new Whisper DNS Baseline input
3. Enter the domain list (comma-separated or one per line)
4. Set the collection interval (default: 24 hours, minimum: 1 hour)
5. Select the destination index