topic Re: What data sources does Splunk for Enterprise Security require? in Splunk Enterprise Security

What data sources does Splunk for Enterprise Security require?

lesterw — Mon, 24 Sep 2012 13:31:47 GMT

Specifically, what data sources does the Splunk for Entrrpise Security REQUIRE? What data sources are OPTIONAL? Is there a complete list somewhere? Thanks.

Re: What data sources does Splunk for Enterprise Security require?

MHibbin — Mon, 24 Sep 2012 14:08:49 GMT

As far as I know, there is no definative list. However referencing the Docs, providing there is a technology add-on for it, then it will be supported by the ES App (ref: http://docs.splunk.com/Documentation/ES/latest/Install/GetdataintoES), but this does not mean, these are your only options... This describes how to add your own custom security events.

You should probably contact Splunk directly for more assistance with your requirements. Splunk is flexible in what it can do, so they will be able to advise you appropriately. It also requires a more unique set-up (rather than your standard use-case).

Re: What data sources does Splunk for Enterprise Security require?

jcoates_splunk — Wed, 26 Sep 2012 01:49:01 GMT

Hi lesterw,

Sorry to give such a floppy answer, but it depends on what you want ES to do. You'll want to pull in at least one type of data for each of the domains that you want to cover. For instance, typically customers will have *nix and Windows data for the Access Protection domain at first, and then expand to database logins, and then expand to custom apps, badge readers, and who knows what else.

ES has domain coverage of the type I just discussed for account management, several endpoint and network technologies, and broader concepts like auditing and threat. To get more specific, I'd recommend checking out the docs.

Re: What data sources does Splunk for Enterprise Security require?

inventsekar — Sun, 25 Aug 2019 05:54:28 GMT

Yeah, this is a great question.. no good answers yet... So commenting it, ..Somebody please reply...thanks

Re: What data sources does Splunk for Enterprise Security require?

dbroggy — Sat, 23 Jan 2021 20:19:28 GMT

Not close to a perfect solution but it works for me:

Run this query to get the rules and SPL:

| rest splunk_server=local count=0 /services/saved/searches |table title, search

Filter down just the titles with the word 'Rule' at the end of the title.

Ok so now you have the rule names and the spl for each.

Then I do some messy sed/awk/grep to extract the data models associated with each - this is optional.

Then I read each rule and it's usually not difficult to guess which logs sources would probably work with those rules - eg:

if the rules starts with 'Access', I put os/auth/AD

Endpoint - endpoint (easy)

etc. etc.

There's ONLY about 350 rules so take some time and you'll at least have a decent short list to focus on.

Re: What data sources does Splunk for Enterprise Security require?

lkutch_splunk — Thu, 28 Jan 2021 18:44:37 GMT

You could use the Use Case Library to see which data sources and source types map to certain types of use cases, based on what you want to do:

https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Usecasecontentlibrary#Determine_which_Analytic_Stories_to_configure