topic Re: SIEM implementation with Splunk Enterprise in Splunk Enterprise

SIEM implementation with Splunk Enterprise

Monica7 — Wed, 23 Nov 2016 11:41:35 GMT

Could you please tell me how to implement SIEM with Splunk Enterprise.

I came to know that there are two ways to Implement SIEM with Splunk
one method is with Splunk Enterprise and another one method is Splunk Enterprise Security. As i will be using free trial version for implementation for now , i cant use Splunk Enterprise security since it is separate volume-based license for the app on top of your regular Splunk license.So could you please share me the document which deals with SIEM Implementation using Splunk Enterprise.

Re: SIEM implementation with Splunk Enterprise

Monica7 — Fri, 25 Nov 2016 04:42:42 GMT

any update on this?

Re: SIEM implementation with Splunk Enterprise

horsefez — Fri, 25 Nov 2016 16:28:38 GMT

Hi,
IMHO:

SIEM isn't a product you can simply implement.
SIEM is more of a status you or your company will reach when a lot of work is done beforehand.
A SIEM is made out of a lot of different use-cases/departments like Network Access Control (NAC), Network Operation Center (NOC), Security Operation Center (SOC) or CERT to name a few.
All those use-cases/departments can use and utilize Splunk of course. But getting to that point are years and years of work.

You can ofc try to only use Splunk Enterprise for all the use-cases I named above. But ES gives you very cool dashboards, a workflow tool and a lot of logic and correalation searches for data insights
You should also read about making your data C.I.M. compliant.