ESA Metrics
uberAgent ESA collects many different metrics, logically grouped into sourcetypes\. All metrics are explained in detail in this chapter, including:
-
Name and description
-
Supported platform
-
Unit and example
-
Related source type and where to find it in the dashboards
-
Calculated fields and and their availability in Splunk's data model and/or \"Search Processing Language\" (SPL)
-
The uberAgent template configuration files can be found at our Github uberAgent-config repository.
Source types
-
uberAgentESA:ActivityMonitoring:ProcessTagging- Threat Detection Metrics -
uberAgentESA:Process:DnsQuery- DNS Query Monitoring Metrics -
uberAgentESA:Process:ProcessStop- Process Stop Metrics -
uberAgentESA:System:ScheduledTaskActions- Scheduled Task Metrics -
uberAgentESA:System:ScheduledTasks- Scheduled Task Metrics -
uberAgentESA:System:ScheduledTaskTriggers- Scheduled Task Metrics -
uberAgentESA:System:SecurityInventory- Security & Compliance Inventory Metrics -
uberAgentESA:System:WinEvtLogForwarding- Event Log Forwarding Metrics