topic Re: Useful security searches in Security https://community.splunk.com/t5/Security/Useful-security-searches/m-p/43849#M1457 <P>Too numerous to cover them all, but the things I have seen are:</P> <P>1) Using "transactions" to find abnormal behavior over a period of time (check out search reference guide to see what I mean).<BR /> 2) Finding correlations across multiple log files (my syslog says this, my checkpoint FW said that, and I got my IDS telling me this....so this is what is going on).<BR /> 3) Creating alerts and notifications that send emails or even log messages to your NOC.</P> <P>The key is to pump data into Splunk and let it "learn" what you put in there. It will tell you things you never knew.</P> Sun, 25 Nov 2012 04:30:41 GMT sd23c109 2012-11-25T04:30:41Z Useful security searches https://community.splunk.com/t5/Security/Useful-security-searches/m-p/43848#M1456 <P>I am new to Splunk and am learning all about it, I was hoping you guys would be able to give me some examples of how I can use Splunk from a security prescriptive, I have already created searches for login failures but what else can Splunk do from a security point of view?</P> <P>Thanks, </P> Fri, 23 Nov 2012 14:23:05 GMT https://community.splunk.com/t5/Security/Useful-security-searches/m-p/43848#M1456 robK123 2012-11-23T14:23:05Z Re: Useful security searches https://community.splunk.com/t5/Security/Useful-security-searches/m-p/43849#M1457 <P>Too numerous to cover them all, but the things I have seen are:</P> <P>1) Using "transactions" to find abnormal behavior over a period of time (check out search reference guide to see what I mean).<BR /> 2) Finding correlations across multiple log files (my syslog says this, my checkpoint FW said that, and I got my IDS telling me this....so this is what is going on).<BR /> 3) Creating alerts and notifications that send emails or even log messages to your NOC.</P> <P>The key is to pump data into Splunk and let it "learn" what you put in there. It will tell you things you never knew.</P> Sun, 25 Nov 2012 04:30:41 GMT https://community.splunk.com/t5/Security/Useful-security-searches/m-p/43849#M1457 sd23c109 2012-11-25T04:30:41Z