https://community.splunk.com/t5/All-Apps-and-Add-ons/Where-is-the-documentation-on-how-to-use-the-Verizon-Data-Breach/m-p/234524#M26362 <P>Ok I installed the app, now what? I have some pretty pull down menus... what do you do next?</P> Fri, 13 Nov 2015 13:07:46 GMT mendesjo 2015-11-13T13:07:46Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Where-is-the-documentation-on-how-to-use-the-Verizon-Data-Breach/m-p/234524#M26362 <P>Ok I installed the app, now what? I have some pretty pull down menus... what do you do next?</P> Fri, 13 Nov 2015 13:07:46 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Where-is-the-documentation-on-how-to-use-the-Verizon-Data-Breach/m-p/234524#M26362 mendesjo 2015-11-13T13:07:46Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Where-is-the-documentation-on-how-to-use-the-Verizon-Data-Breach/m-p/234525#M26363 <P>Per <A href="https://answers.splunk.com/users/138264/jkat54.html?utm_source=answers&amp;utm_medium=email&amp;utm_term=jkat54&amp;utm_content=&amp;utm_campaign=mention">jkat54</A> on question <A href="https://answers.splunk.com/answers/257867/">257867</A>, please have a look at:</P> <P><CODE>$SPLUNK_HOME/etc/apps/DBIR_splunk_app/appserver/static/html/dbir_help_basic.html</CODE></P> <P>Also, similar to Enterprise Security, the PCI app for Splunk, and ITSI, your data will need to be normalized to conform to the Common Information Model (CIM) to integrate with DBIR. More information on CIM can be found here: <A href="http://docs.splunk.com/Documentation/CIM/4.3.1/User/Overview">Common Information Model Add-on Manual</A>. <A href="https://splunkbase.splunk.com/app/1621/">CIM app</A></P> Fri, 13 Nov 2015 19:59:35 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Where-is-the-documentation-on-how-to-use-the-Verizon-Data-Breach/m-p/234525#M26363 nnmiller 2015-11-13T19:59:35Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Where-is-the-documentation-on-how-to-use-the-Verizon-Data-Breach/m-p/234526#M26364 <P>Thanks for the reply. So, does this app somehow coorelate existing data in my splunk environment with Verizon's data? How will it obtain the Verizon information, does it down load it somehow? </P> Fri, 13 Nov 2015 20:15:31 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Where-is-the-documentation-on-how-to-use-the-Verizon-Data-Breach/m-p/234526#M26364 mendesjo 2015-11-13T20:15:31Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Where-is-the-documentation-on-how-to-use-the-Verizon-Data-Breach/m-p/234527#M26365 <P>Based on this <A href="http://news.verizonenterprise.com/2015/09/verizon-splunk-dbir-app-security/">press release</A>, and looking at the app, it appears using the DBIR historical data which is contained within the application itself.</P> <P>There are more HTML help files in that html directory I mentioned in my answer.</P> <P>If you are not familiar with CIM, then I strongly suggest you read the CIM documentation before going further with this app, since understanding how to normalize data (source typing, event types, tags), is essential.</P> Fri, 13 Nov 2015 21:44:46 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Where-is-the-documentation-on-how-to-use-the-Verizon-Data-Breach/m-p/234527#M26365 nnmiller 2015-11-13T21:44:46Z