topic Re: How to generate a report based on utilisation of Enterprise Security in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674799#M11888 <P>Thank you very much, that has helped me.</P><P>Have a good one</P> Fri, 19 Jan 2024 08:39:47 GMT cYcJo7 2024-01-19T08:39:47Z How to generate a report based on utilisation of Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674643#M11884 <P>Hello,</P><P>&nbsp;</P><P>is it possible to analyse the utilisation of enterprise security, I assume it is currently not used in our company, but I would like to be able to prove this in statistics</P><P>&nbsp;</P><P>Thanks</P><P>Pad</P> Thu, 18 Jan 2024 11:15:31 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674643#M11884 cYcJo7 2024-01-18T11:15:31Z Re: How to generate a report based on utilisation of Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674646#M11885 <P>#define &lt;utilisation&gt; please</P> Thu, 18 Jan 2024 11:29:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674646#M11885 PickleRick 2024-01-18T11:29:59Z Re: How to generate a report based on utilisation of Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674647#M11886 <P>Thank you for your quick reply, I would like to know if Enterprise security is used at all in our company. So is it used 1-2 times a year or has it only been used 10 times in the last 3 months?</P> Thu, 18 Jan 2024 11:34:44 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674647#M11886 cYcJo7 2024-01-18T11:34:44Z Re: How to generate a report based on utilisation of Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674651#M11887 <P>Again - there are several different approaches you can have about "using ES" but what I'd do to get a rough idea if the solution is indeed being used:</P><P>1. Check if it's configured - are there correlation searches defined, are there user/asset mappings defined/synchronised, are sources decently onboarded (CIM-compliant)</P><P>2. Does anyone actually open ES app views in webui (you should be able to find it in internal logs).</P><P>3. What is the status of your notables and investigations - do you see any traces of anyone working on them?</P><P>4. What is the version of your ESCU app? How long ago it's been updated?</P> Thu, 18 Jan 2024 12:45:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674651#M11887 PickleRick 2024-01-18T12:45:23Z Re: How to generate a report based on utilisation of Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674799#M11888 <P>Thank you very much, that has helped me.</P><P>Have a good one</P> Fri, 19 Jan 2024 08:39:47 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-generate-a-report-based-on-utilisation-of-Enterprise/m-p/674799#M11888 cYcJo7 2024-01-19T08:39:47Z