DFUR-Splunk-App

This repo contains the "DFUR" Splunk application and pre-indexed data referenced in the 2020 SANS DFIR Summit presentation "Captain's Log: Take your application log analysis from Starfleet to Star Fleek" by David Pany and Ryan Tomcik. Get started by installing the application in Splunk and opening up the "DFUR Monitoring" dashboard. Or strip it for parts. Either way, enjoy!

Questions / Comments

Twitter: @heferyzan

Splunk Requirements

App / Add-on	Download	Notes
Splunk Enterprise / Free	http://www.splunk.com
Haversine	https://splunkbase.splunk.com/app/936/	If the Haversine application can't be uploaded through the Splunk UI, then extract the file contents to $SPLUNK_HOME/etc/apps
ASN Lookup Generator	https://splunkbase.splunk.com/app/3531/	Requires the asngen command to be executed to populate the asn lookup