@extends('layouts.main') @section('title', 'MSS-CLOUD — Cloud Application Protection') @section('breadcrumb')

MSS-CLOUD — Cloud Application Protection

  1. Home
  2. MSS-CLOUD
@endsection @inject('splunk_searches', '\App\Models\SplunkSearches') @php $dashboard = 'MSS-CLOUD'; // OVERVIEW $wCAPS = $splunk_searches::getIdByName('Cloud Application Protection Score (CAPS)', $dashboard); $wDataConfidence = $splunk_searches::getIdByName('Data Confidence', $dashboard); $wComponentScores = $splunk_searches::getIdByName('Component Scores', $dashboard); $wCoverageSummary = $splunk_searches::getIdByName('Protection Coverage Summary', $dashboard); $wAssetsTargeting = $splunk_searches::getIdByName('Assets Under Active Targeting', $dashboard); $wActiveThreats = $splunk_searches::getIdByName('Active Threat Indicators', $dashboard); $wTopFindings = $splunk_searches::getIdByName('Top Findings Requiring Action', $dashboard); $wCAPSTrend = $splunk_searches::getIdByName('CAPS Trend', $dashboard); // WAF $wWafPer = $splunk_searches::getIdByName('WAF Protection Effectiveness Rating (WAF-PER)', $dashboard); $wLowSeverity = $splunk_searches::getIdByName('Low-Severity Monitor Activity', $dashboard); $wOwasp = $splunk_searches::getIdByName('OWASP Coverage & Active Threats', $dashboard); $wGeoThreat = $splunk_searches::getIdByName('Geographic Threat Concentration', $dashboard); $wWafPolicy = $splunk_searches::getIdByName('WAF Policy Posture', $dashboard); $wCertExpiry = $splunk_searches::getIdByName('Certificate Expiry Monitor', $dashboard); $wAppsUnderAttack = $splunk_searches::getIdByName('Applications Under Attack (Business View)', $dashboard); $wTopAttacked = $splunk_searches::getIdByName('Top Attacked Applications', $dashboard); $wAppEventTrend = $splunk_searches::getIdByName('Application Security Event Trend (30d)', $dashboard); $wAttackTypeTrend = $splunk_searches::getIdByName('Attack Type Trend (6 months)', $dashboard); $wFalsePositive = $splunk_searches::getIdByName('Potential False Positive Indicator', $dashboard); // DDOS PROTECTION $wDdosPer = $splunk_searches::getIdByName('DDOS-PER', $dashboard); $wActiveAttack = $splunk_searches::getIdByName('Active Attack Status', $dashboard); $wProtectedAssets = $splunk_searches::getIdByName('Protected Assets Under Attack', $dashboard); $wBlockingCompleteness = $splunk_searches::getIdByName('Blocking Completeness by Asset', $dashboard); $wAttackSeverity = $splunk_searches::getIdByName('Attack Severity Distribution', $dashboard); $wAttackDuration = $splunk_searches::getIdByName('Attack Duration Analysis', $dashboard); $wRecurringSources = $splunk_searches::getIdByName('Recurring Attack Sources', $dashboard); $wBandwidth = $splunk_searches::getIdByName('Bandwidth Consumption by Attack Type', $dashboard); $wAttackTrend = $splunk_searches::getIdByName('Attack Trend (6 months)', $dashboard); $wGeoAttack = $splunk_searches::getIdByName('Geographic Attack Concentration', $dashboard); // BOT PROTECTION $wAllowedBot = $splunk_searches::getIdByName('Allowed Bot Transactions', $dashboard); $wBotPer = $splunk_searches::getIdByName('BOT-PER (7d)', $dashboard); $wBotCategory = $splunk_searches::getIdByName('Bot Category Risk Assessment', $dashboard); $wBotSource = $splunk_searches::getIdByName('Top Bot Source Concentration', $dashboard); $wBotPolicy = $splunk_searches::getIdByName('Bot Policy Posture', $dashboard); $wBotTiming = $splunk_searches::getIdByName('Bot Activity Timing', $dashboard); $wBotVolume = $splunk_searches::getIdByName('Bot Volume Trend (30d)', $dashboard); $wBotImpact = $splunk_searches::getIdByName('Allowed Bot Impact Trend (30d)', $dashboard); $wHighRiskPath = $splunk_searches::getIdByName('High-Risk Path Exposure', $dashboard); $wUaProfile = $splunk_searches::getIdByName('User-Agent Technique Profile', $dashboard); // ASSET IMPACT CORRELATION $wAssetCorrelation = $splunk_searches::getIdByName('Asset Impact Correlation', $dashboard); // PROTECTION HISTORY $wOpenCases = $splunk_searches::getIdByName('Open INCIDENT CASEs', $dashboard); $wCaseHistory = $splunk_searches::getIdByName('Incident Case History', $dashboard); $wCaseTrend = $splunk_searches::getIdByName('INCIDENT CASE Trend', $dashboard); $wCAPSHistory = $splunk_searches::getIdByName('CAPS Score History', $dashboard); $wComponentHistory = $splunk_searches::getIdByName('Component Score History', $dashboard); $wRecurringPatterns = $splunk_searches::getIdByName('Recurring Attack Patterns', $dashboard); $wAppEvolution = $splunk_searches::getIdByName('Application Protection Evolution', $dashboard); $wPolicyTuning = $splunk_searches::getIdByName('Policy Tuning Effectiveness', $dashboard); // DATA QUALITY $wLiveFeeds = $splunk_searches::getIdByName('Live Feeds (fresh <24h)', $dashboard); $wStaleFeeds = $splunk_searches::getIdByName('Stale Feeds (>48h)', $dashboard); $wTotalEvents = $splunk_searches::getIdByName('Total Events (7d, this client)', $dashboard); $wCADCoverage = $splunk_searches::getIdByName('CAD Enrichment Completeness', $dashboard); $wFeedHealth = $splunk_searches::getIdByName('Feed Health Matrix', $dashboard); $wBrokenFeeds = $splunk_searches::getIdByName('Broken / Stale Feeds', $dashboard); $wEventVolume = $splunk_searches::getIdByName('Event Volume by Feed (7d)', $dashboard); $tooltips = [ 'Cloud Application Protection Score (CAPS)' => 'Composite Cloud Application Protection Score — weighted blend of WAF-PER and BOT-PER by threat severity x CAD criticality.', 'Data Confidence' => 'Feed freshness: High = both feeds fresh <48h, Degraded = one feed stale, Low = both stale.', 'Component Scores' => 'WAF-PER, BOT-PER, DDOS-PER individual scores and CAPS eligibility.', 'Protection Coverage Summary' => 'Event-level coverage per component: total events, % protected, % allowed.', 'Assets Under Active Targeting' => 'Applications receiving WAF or Bot events in last 24h ranked by volume and CAD criticality.', 'Active Threat Indicators' => 'Active high/critical WAF threats on CAD-classified applications in last 24h.', 'Top Findings Requiring Action' => 'Highest priority findings: allowed attacks on critical/high applications and bot enforcement gaps.', 'CAPS Trend' => 'CAPS score trend over time from daily score history.', 'WAF Protection Effectiveness Rating (WAF-PER)' => 'WAF-PER: weighted mitigation rate for Critical/High/Medium events by severity x CAD criticality. 7-day window.', 'Low-Severity Monitor Activity' => 'Low and Warning severity WAF events — informational, not counted in WAF-PER.', 'OWASP Coverage & Active Threats' => 'Distribution of WAF events by OWASP Top 10 category.', 'Geographic Threat Concentration' => 'Map of WAF attack sources by country.', 'WAF Policy Posture' => 'Per-application protection module status.', 'Certificate Expiry Monitor' => 'SSL/TLS certificate expiry. CRITICAL ≤14d, WARNING ≤30d.', 'Applications Under Attack (Business View)' => 'Applications receiving WAF events ranked by CAD criticality.', 'Top Attacked Applications' => 'Top 10 most attacked applications by total WAF event count.', 'Application Security Event Trend (30d)' => 'Daily WAF event volume trend over 30 days.', 'Attack Type Trend (6 months)' => 'Weekly attack volume trend by violation type over 6 months.', 'Potential False Positive Indicator' => 'Applications with block spikes or high % business-path blocks.', 'DDOS-PER' => 'DDoS Protection Effectiveness Rating weighted by CAD criticality.', 'Active Attack Status' => 'Ongoing DDoS attacks (no end timestamp) in last 24h.', 'Protected Assets Under Attack' => 'Assets receiving DDoS events in last 7d with blocking completeness.', 'Blocking Completeness by Asset' => 'Bandwidth-weighted blocking completeness per asset.', 'Attack Severity Distribution' => 'DDoS attack count by severity and attack type.', 'Attack Duration Analysis' => 'Distribution of DDoS attack durations over last 30 days.', 'Recurring Attack Sources' => 'Attack sources with 3+ hits in 7 days — potential campaign.', 'Bandwidth Consumption by Attack Type' => 'Total bandwidth consumed by each DDoS attack type.', 'Attack Trend (6 months)' => 'Daily DDoS attack count trend over 6 months.', 'Geographic Attack Concentration' => 'Map of DDoS attack sources by country.', 'Allowed Bot Transactions' => 'Total bot transactions with response_code=Allow.', 'BOT-PER (7d)' => 'Bot Protection Effectiveness Rating over 7 days. Monitor mode = no enforcement.', 'Bot Category Risk Assessment' => 'Risk weight and allow rate per bot category.', 'Top Bot Source Concentration' => 'Top 10 bot source IPs by event volume.', 'Bot Policy Posture' => 'Percentage of each bot category that is allowed.', 'Bot Activity Timing' => 'Hourly bot activity heatmap by category.', 'Bot Volume Trend (30d)' => 'Daily total bot event volume over 30 days.', 'Allowed Bot Impact Trend (30d)' => 'Daily volume of allowed bot transactions over 30 days.', 'High-Risk Path Exposure' => 'Bot hits on authentication, payment, and account management paths.', 'User-Agent Technique Profile' => 'Bot traffic classified by user-agent technique.', 'Asset Impact Correlation' => 'WAF Crit/High findings and high-risk bot activity correlated with CAD asset criticality.', 'CAPS Score History' => 'Historical CAPS score trend from daily score history.', 'Component Score History' => 'Historical WAF-PER and BOT-PER trends.', 'Recurring Attack Patterns' => 'Attack types recurring 3+ times on same application over 90 days.', 'Application Protection Evolution' => 'Weekly trend of applications onboarded under WAF protection.', 'Policy Tuning Effectiveness' => 'Daily WAF-PER trend over 180 days.', 'Open INCIDENT CASEs' => 'Active incident cases (Open/Answered/Suspended) for this client — excludes closed cases.', 'Incident Case History' => 'Complete historical log of all incident cases for this client, most recent first.', 'INCIDENT CASE Trend' => 'Monthly trend of Critical and High severity incident cases over 12 months.', 'CAD Enrichment Completeness' => 'Percentage of protected applications with CAD criticality defined. Target: 95%+.', 'Live Feeds (fresh <24h)' => 'Number of data feeds with events in last 24 hours.', 'Stale Feeds (>48h)' => 'Number of data feeds with no events for more than 48 hours.', 'Total Events (7d, this client)' => 'Total event count across all MSS-CLOUD feeds in last 7 days.', 'Feed Health Matrix' => 'Per-feed health: OK / WATCH / STALE based on last event timestamp.', 'Broken / Stale Feeds' => 'Feeds with no events for more than 48 hours.', 'Event Volume by Feed (7d)' => 'Event count per feed type in last 7 days.', ]; @endphp @section('content')
@include('dashboards.ecsm.incl_report_button', ['report_name' => 'MSS-CLOUD Report']) @include('dashboards.ecsm.incl_docs_button', ['docs' => \App\Models\SplunkDashboards::getDocuments('MSS-CLOUD')])
@if($wCAPS)

Cloud Application Protection Score (CAPS)

{!! $splunk_searches::getCodeArray([$wCAPS], $from, $to) !!}
@endif
@if($wDataConfidence)

Data Confidence

{!! $splunk_searches::getCodeArray([$wDataConfidence], $from, $to) !!}
@endif
@if($wComponentScores)

Component Scores

{!! $splunk_searches::getCodeArray([$wComponentScores], $from, $to) !!}
@endif
@if($wCoverageSummary)

Protection Coverage Summary

{!! $splunk_searches::getCodeArray([$wCoverageSummary], $from, $to) !!}
@endif
@if($wAssetsTargeting)

Assets Under Active Targeting

{!! $splunk_searches::getCodeArray([$wAssetsTargeting], $from, $to) !!}
@endif
@if($wActiveThreats)

Active Threat Indicators

{!! $splunk_searches::getCodeArray([$wActiveThreats], $from, $to) !!}
@endif
@if($wTopFindings)

Top Findings Requiring Action

{!! $splunk_searches::getCodeArray([$wTopFindings], $from, $to) !!}
@endif
@if($wCAPSTrend)

CAPS Trend

{!! $splunk_searches::getCodeArray([$wCAPSTrend], $from, $to) !!}
@endif
{{-- Row 5 (1): Open INCIDENT CASEs --}}
@if($wOpenCases)

Open INCIDENT CASEs

{!! $splunk_searches::getCodeArray([$wOpenCases], $from, $to) !!}
@endif
{{-- Row 1 (1): WAF-PER --}}
@if($wWafPer)

WAF Protection Effectiveness Rating (WAF-PER)

{!! $splunk_searches::getCodeArray([$wWafPer], $from, $to) !!}
@endif
{{-- Row 2 (3): Low-Severity | OWASP | Geographic --}}
@if($wLowSeverity)

Low-Severity Monitor Activity

{!! $splunk_searches::getCodeArray([$wLowSeverity], $from, $to) !!}
@endif
@if($wOwasp)

OWASP Coverage & Active Threats

{!! $splunk_searches::getCodeArray([$wOwasp], $from, $to) !!}
@endif
@if($wGeoThreat)

Geographic Threat Concentration

{!! $splunk_searches::getCodeArray([$wGeoThreat], $from, $to) !!}
@endif
{{-- Row 3 (2): WAF Policy | Certificate Expiry --}}
@if($wWafPolicy)

WAF Policy Posture

{!! $splunk_searches::getCodeArray([$wWafPolicy], $from, $to) !!}
@endif
@if($wCertExpiry)

Certificate Expiry Monitor

{!! $splunk_searches::getCodeArray([$wCertExpiry], $from, $to) !!}
@endif
{{-- Row 4 (2): Apps Under Attack | Top Attacked --}}
@if($wAppsUnderAttack)

Applications Under Attack (Business View)

{!! $splunk_searches::getCodeArray([$wAppsUnderAttack], $from, $to) !!}
@endif
@if($wTopAttacked)

Top Attacked Applications

{!! $splunk_searches::getCodeArray([$wTopAttacked], $from, $to) !!}
@endif
{{-- Row 5 (2): App Event Trend | Attack Type Trend --}}
@if($wAppEventTrend)

Application Security Event Trend (30d)

{!! $splunk_searches::getCodeArray([$wAppEventTrend], $from, $to) !!}
@endif
@if($wAttackTypeTrend)

Attack Type Trend (6 months)

{!! $splunk_searches::getCodeArray([$wAttackTypeTrend], $from, $to) !!}
@endif
{{-- Row 6 (1): False Positive Indicator --}}
@if($wFalsePositive)

Potential False Positive Indicator

{!! $splunk_searches::getCodeArray([$wFalsePositive], $from, $to) !!}
@endif
@if($wDdosPer)

DDOS-PER

{!! $splunk_searches::getCodeArray([$wDdosPer], $from, $to) !!}
@endif
@if($wActiveAttack)

Active Attack Status

{!! $splunk_searches::getCodeArray([$wActiveAttack], $from, $to) !!}
@endif
@if($wProtectedAssets)

Protected Assets Under Attack

{!! $splunk_searches::getCodeArray([$wProtectedAssets], $from, $to) !!}
@endif
@if($wBlockingCompleteness)

Blocking Completeness by Asset

{!! $splunk_searches::getCodeArray([$wBlockingCompleteness], $from, $to) !!}
@endif
@if($wAttackSeverity)

Attack Severity Distribution

{!! $splunk_searches::getCodeArray([$wAttackSeverity], $from, $to) !!}
@endif
@if($wAttackDuration)

Attack Duration Analysis

{!! $splunk_searches::getCodeArray([$wAttackDuration], $from, $to) !!}
@endif
@if($wRecurringSources)

Recurring Attack Sources

{!! $splunk_searches::getCodeArray([$wRecurringSources], $from, $to) !!}
@endif
@if($wBandwidth)

Bandwidth Consumption by Attack Type

{!! $splunk_searches::getCodeArray([$wBandwidth], $from, $to) !!}
@endif
@if($wAttackTrend)

Attack Trend (6 months)

{!! $splunk_searches::getCodeArray([$wAttackTrend], $from, $to) !!}
@endif
@if($wGeoAttack)

Geographic Attack Concentration

{!! $splunk_searches::getCodeArray([$wGeoAttack], $from, $to) !!}
@endif
@if($wAllowedBot)

Allowed Bot Transactions

{!! $splunk_searches::getCodeArray([$wAllowedBot], $from, $to) !!}
@endif
@if($wBotPer)

BOT-PER (7d)

{!! $splunk_searches::getCodeArray([$wBotPer], $from, $to) !!}
@endif
@if($wBotCategory)

Bot Category Risk Assessment

{!! $splunk_searches::getCodeArray([$wBotCategory], $from, $to) !!}
@endif
@if($wBotSource)

Top Bot Source Concentration

{!! $splunk_searches::getCodeArray([$wBotSource], $from, $to) !!}
@endif
@if($wBotPolicy)

Bot Policy Posture

{!! $splunk_searches::getCodeArray([$wBotPolicy], $from, $to) !!}
@endif
@if($wBotTiming)

Bot Activity Timing

{!! $splunk_searches::getCodeArray([$wBotTiming], $from, $to) !!}
@endif
@if($wBotVolume)

Bot Volume Trend (30d)

{!! $splunk_searches::getCodeArray([$wBotVolume], $from, $to) !!}
@endif
@if($wBotImpact)

Allowed Bot Impact Trend (30d)

{!! $splunk_searches::getCodeArray([$wBotImpact], $from, $to) !!}
@endif
@if($wHighRiskPath)

High-Risk Path Exposure

{!! $splunk_searches::getCodeArray([$wHighRiskPath], $from, $to) !!}
@endif
@if($wUaProfile)

User-Agent Technique Profile

{!! $splunk_searches::getCodeArray([$wUaProfile], $from, $to) !!}
@endif
@if($wAssetCorrelation)

Asset Impact Correlation

{!! $splunk_searches::getCodeArray([$wAssetCorrelation], $from, $to) !!}
@endif
{{-- Row 1 (2): CAPS History + Component History --}}
@if($wCAPSHistory)

CAPS Score History

{!! $splunk_searches::getCodeArray([$wCAPSHistory], $from, $to) !!}
@endif
@if($wComponentHistory)

Component Score History

{!! $splunk_searches::getCodeArray([$wComponentHistory], $from, $to) !!}
@endif
{{-- Row 2 (2): Recurring Patterns + App Evolution --}}
@if($wRecurringPatterns)

Recurring Attack Patterns

{!! $splunk_searches::getCodeArray([$wRecurringPatterns], $from, $to) !!}
@endif
@if($wAppEvolution)

Application Protection Evolution

{!! $splunk_searches::getCodeArray([$wAppEvolution], $from, $to) !!}
@endif
{{-- Row 3 (1): Policy Tuning --}}
@if($wPolicyTuning)

Policy Tuning Effectiveness

{!! $splunk_searches::getCodeArray([$wPolicyTuning], $from, $to) !!}
@endif
{{-- Row 4 (1): INCIDENT CASE Trend --}}
@if($wCaseTrend)

INCIDENT CASE Trend

{!! $splunk_searches::getCodeArray([$wCaseTrend], $from, $to) !!}
@endif
{{-- Row 5 (1): Incident Case History --}}
@if($wCaseHistory)

Incident Case History

{!! $splunk_searches::getCodeArray([$wCaseHistory], $from, $to) !!}
@endif
{{-- Row 1 (1): CAD Enrichment Completeness --}}
@if($wCADCoverage)

CAD Enrichment Completeness

{!! $splunk_searches::getCodeArray([$wCADCoverage], $from, $to) !!}
@endif
{{-- Row 2 (3): Live Feeds | Stale Feeds | Total Events --}}
@if($wLiveFeeds)

Live Feeds (fresh <24h)

{!! $splunk_searches::getCodeArray([$wLiveFeeds], $from, $to) !!}
@endif
@if($wStaleFeeds)

Stale Feeds (>48h)

{!! $splunk_searches::getCodeArray([$wStaleFeeds], $from, $to) !!}
@endif
@if($wTotalEvents)

Total Events (7d, this client)

{!! $splunk_searches::getCodeArray([$wTotalEvents], $from, $to) !!}
@endif
{{-- Row 3 (1): Feed Health Matrix --}}
@if($wFeedHealth)

Feed Health Matrix

{!! $splunk_searches::getCodeArray([$wFeedHealth], $from, $to) !!}
@endif
{{-- Row 4 (2): Broken Feeds | Event Volume --}}
@if($wBrokenFeeds)

Broken / Stale Feeds

{!! $splunk_searches::getCodeArray([$wBrokenFeeds], $from, $to) !!}
@endif
@if($wEventVolume)

Event Volume by Feed (7d)

{!! $splunk_searches::getCodeArray([$wEventVolume], $from, $to) !!}
@endif
@include('dashboards.ecsm.news_top')
@endsection @section('scripts') @endsection @section('top_scripts') @endsection