Does Splunk ESS include correlation rules for malware activities?

Max — Tue, 31 May 2011 10:31:54 GMT

Does Splunk ESS include, out of the box - functionalities that do not require any additional installation, correlation rules and alert for malware (worm, virus, ecc...) activities?

Thanks in advance,

Max

Re: Does Splunk ESS include correlation rules for malware activities?

hazekamp — Tue, 31 May 2011 17:58:58 GMT

maxlanzi,

We have several OOTB correlation searches that leverage data provided by your Antivirus/Malware solutions.

Endpoint - Host With Multiple Infections - Rule
Endpoint - Old Malware Infection - Rule
Endpoint - High Number of Hosts With Infection - Rule
Endpoint - High Number Of Infected Hosts - Rule
Endpoint - High Or Critical Priority Host With Malware - Rule
Endpoint - Recurring Malware Infection - Rule
Endpoint - Outbreak Observed - Rule

We also have a number of OOTB correlation searches that discover activity indicative of malware, but leverage other data sets such as Firewall/Proxy.

If you need a comprehensive list of correlation searches and descriptions, please contact Splunk Sales.

topic Re: Does Splunk ESS include correlation rules for malware activities? in Splunk Enterprise Security

Does Splunk ESS include correlation rules for malware activities?

Re: Does Splunk ESS include correlation rules for malware activities?