topic Splunk Security Essentials onboard data/use case creation in Security

Splunk Security Essentials onboard data/use case creation

vinothn — Sat, 10 Oct 2020 15:08:31 GMT

Hi Team,

We are trying to get data on boarded to splunk security essentials.

We do not have a clear visibility to the functioning of the app, I have now onboarded DNS data onto my Splunk Indexer using the Splunk Stream app, Its in the index=netdns as per splunk docs specification.

Now how do I turn on all the use cases related to DNS in splunk security essentials.

Followed the onboarding guide which provided in the app.(https://docs.splunksecurityessentials.com/data-onboarding-guides/stream-dns/)

Re: Splunk Security Essentials onboard data/use case creation

johnsasikumar — Sat, 10 Oct 2020 15:10:34 GMT

Hi All,

I too have the same issue, The documents are not clear enough as how we have to activate the use cases in the splunk security essentials app. Please could someone shed some light on this.

Thanks

John

Re: Splunk Security Essentials onboard data/use case creation

niroy_splunk — Mon, 19 Oct 2020 15:36:28 GMT

There's a walkthrough here for how you can track content and data in your Splunk environment and how to operationalize it using different features in the Analytics Advisor section: https://docs.splunksecurityessentials.com/user/productionalize/operationalize_mitre_attack/