Splunk dashboard for Windows Event Collection - Process Creation

Windows Event Collection - Process Creation

<form>
  <label>Windows Event Collection - Process Creation</label>
  <description>Filtered search to discover new processes</description>
  <fieldset submitButton="false" autoRun="true">
    <input type="text" token="computername" searchWhenChanged="true">
      <label>Computer Name (FQDN)</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="processname" searchWhenChanged="true">
      <label>Process Name</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="username" searchWhenChanged="true">
      <label>User Name</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>    
    <input type="time" token="time" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Process Creation Trend (Graphic)</title>
        <search>
          <query>index=windows EventCode=4688 
          | search ComputerName=$computername$ New_Process_Name=$processname$ Account_Name=$username$ 
          | timechart span=5m count by New_Process_Name
          </query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Stats by Process Creation</title>
        <search>
          <query>index=windows EventCode=4688 
          | eval User=mvindex(User, 1)
          | search ComputerName=$computername$ New_Process_Name=$processname$ Account_Name=$username$ 
          | stats count(New_Process_Name) as count by New_Process_Name
          | sort - count
          </query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Stats by User</title>
        <search>
          <query>index=windows EventCode=4688 
          | eval Account_Name=mvindex(Account_Name, 1)
          | search ComputerName=* New_Process_Name=* 
          | stats count(Account_Name) as count by Account_Name
          | sort - count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Process Creation Activities</title>
        <search>
          <query>index=windows EventCode=4688 
          | eval Account_Name=mvindex(Account_Name,0) 
          | eval Account_Domain=mvindex(Account_Domain,1) 
          | search ComputerName=$computername$ New_Process_Name=$processname$ Account_Name=$username$ 
          | table _time,ComputerName,Account_Domain,Account_Name,Security_ID,New_Process_Name
          </query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
          <refresh>10m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>