topic Re: Splunk as a SIEM Best Practices for Security Professionals in Security

Splunk as a SIEM Best Practices for Security Professionals

aking76 — Thu, 25 Jul 2019 17:14:17 GMT

Just curious if there is any documentation to help understand the best practices to use Splunk Enterprise as a SIEM for Security Professionals / SOC analysts.

Or if anyone has any input, that would be appreciated as well.

I have been evaluating Splunk Security Essentials, which I've been using to create dashboards.

Re: Splunk as a SIEM Best Practices for Security Professionals

ChrisG — Thu, 25 Jul 2019 17:20:38 GMT

You might find some relevant information about best practices and use cases in the recordings of previous Splunk user conference sessions: https://conf.splunk.com/watch/conf-online.html?search=siem#/ .

Re: Splunk as a SIEM Best Practices for Security Professionals

sloshburch — Mon, 29 Jul 2019 16:25:34 GMT

Keep in mind that Splunk Enterprise Security and Splunk Security Essentials are two different things.

Splunk Enterprise Security - Splunk Enterprise Security is the nerve center of the security ecosystem, giving teams the insight to quickly detect and respond to internal and external attacks, simplify threat management minimizing risk.
Splunk Security Essentials - Showcase of many security examples possible with Splunk

Re: Splunk as a SIEM Best Practices for Security Professionals

mmerza_splunk — Mon, 29 Jul 2019 19:33:01 GMT

Lots of splunk searches, explanations, and mappings to MITRE ATT&CK here: https://splunkbase.splunk.com/app/3449/

the app is updated regularly by splunk's security research team.

Re: Splunk as a SIEM Best Practices for Security Professionals

wenthold — Mon, 29 Jul 2019 21:16:15 GMT

Enrich your data with asset & user information where possible (Enterprise Security has this built in)
Build alerts with a specific use case in mind - mmerza mentioned MITRE ATT&CK and rightfully so, but it doesn't contain all uses cases you may want to look for
Use the CIM & datamodel acceleration
Link alerts to playbooks/response plans
It's only as good as the data you feed it but don't just put data in without an idea of how it will be used

I guess the overall theme is whatever you do, do it with a plan.