Splunk Security Essentials - data available

astatrial — Mon, 10 May 2021 11:08:07 GMT

Hi all,

I have the Splunk Security Essentials app installed and configured.

I am trying to understand how the app determine if a rule has data or not, because there are rules that do have logs but their status is "needs data".

There is the commend sseanalytics, but I am not sure how it works.

Thanks !

topic Splunk Security Essentials - data available in Security

Splunk Security Essentials - data available