topic Re: analyze this data in Splunk in Security

analyze this data in Splunk

tuts — Wed, 31 Jul 2024 08:11:56 GMT

Scenario: The device has been compromised, and we want to understand how the breach occurred. We have extracted data from the device from the Setup, Security, and Application logs in CSV format and uploaded it to Splunk.

Question: What is the best way to automatically analyze this data in Splunk and identify any suspicious information

Re: analyze this data in Splunk

gcusello — Wed, 31 Jul 2024 08:24:21 GMT

Hi @tuts ,

I performed a similar search in the past: there's no automatic analysis that you can perform, youcan search for the inbound accesses and outbound transaction, you can only search, with a security specialist to identify some possible threat or compromise.

Ciao.

Giuseppe

Re: analyze this data in Splunk

tuts — Wed, 31 Jul 2024 08:54:13 GMT

That's sad.
Are there other tools that help me with analysis?
And what do you advise

Re: analyze this data in Splunk

tuts — Wed, 31 Jul 2024 09:00:49 GMT

That's sad.
Are there other tools that help me with analysis?
And what do you advise

Re: analyze this data in Splunk

gcusello — Wed, 31 Jul 2024 09:11:28 GMT

Hi @tuts ,

in my opinion, only the knowledge of a security analyst can help you in the search.

You could install some app for the technologies you have but, I think that only a deep knowledge of attack methods and technics can support you.

Ciao.

Giuseppe