Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.
IR teams need real-time dashboards during active incidents for coordination and tracking
SOC leadership requires operational dashboards showing incident status and analyst workload
Post-incident reviews need visual timelines and impact assessments
Executive briefings require high-level incident metrics and trend analysis
Do not use for day-to-day SOC monitoring dashboards (use Incident Review instead) — IR dashboards are designed for active incident coordination and management reporting.
Common Misconfigurations & Verification
Panel querying the wrong index/field: the MTTD/MTTR panels read index=notable with orig_time, status_end, time_of_first_event — if your ES version stores these under incident_review or the field is null, the single/timechart renders 0 or "No results" rather than erroring. Run each panel's base search standalone and confirm non-null values before trusting the tile.
Stale inputlookup data: panels backed by ir_affected_systems.csv/ir_ioc_list.csv show whatever was last written; if the Step 7 scheduled search isn't enabled (or writes to ir_affected_systems_auto.csv while the panel reads ir_affected_systems.csv), the dashboard silently displays frozen counts during a live incident. Verify the outputlookup target matches the panel's inputlookup name and the schedule is actually running.
Hardcoded incident scope: the IOC panels pin literal IPs/hashes and earliest="2024-03-14". Reused for a new incident they show the old incident's data. Parameterize with dashboard tokens ($incident_id$, $earliest$) and confirm the tokens propagate.
Time-range/timezone mismatch: epoch math (now()-strptime(...)) assumes the dashboard TZ matches event TZ; a user in another TZ sees skewed "hours elapsed".
Verification: load the dashboard against a known closed incident and reconcile every panel (affected hosts, IOC counts, timeline rows) against the case record; confirm a permission-scoped analyst account can actually read the notable index and lookups, not just the dashboard author.
Prerequisites
SIEM platform (Splunk with Dashboard Studio, Elastic Kibana, or Grafana)
Notable event and incident data in SIEM (Splunk ES incident_review index)
Ticketing system integration (ServiceNow, Jira) for remediation tracking
Asset and identity lookup tables for context enrichment
Dashboard publishing access for SOC team and management distribution
Workflow
Step 1: Design Active Incident Dashboard Layout
Build a Splunk Dashboard Studio dashboard for active incident tracking:
--- IOCs identified during incident
index=* (src_ip IN ("185.234.218.50", "45.77.123.45") OR
dest IN ("evil-c2.com", "malware-drop.com") OR
file_hash IN ("a1b2c3d4...", "e5f6a7b8..."))
earliest="2024-03-14"
| stats count AS hits, dc(src_ip) AS unique_sources,
dc(dest) AS unique_dests, latest(_time) AS last_seen
by sourcetype
| sort - hits
--- IOC timeline
index=* (src_ip IN ("185.234.218.50") OR dest="evil-c2.com")
earliest="2024-03-14"
| timechart span=1h count by sourcetype
--- New IOC discovery tracking
| inputlookup ir_ioc_list.csv
| stats count by ioc_type, source, discovery_time
| sort discovery_time
| table discovery_time, ioc_type, ioc_value, source, status
