https://community.splunk.com/t5/Splunk-Enterprise-Security/Learning-SIEM-basics/m-p/241153#M1645 <P>My advice: do not think about product, but think about your needs: what are the risk for your company, mainly the business ones ?<BR /> Then, you will be able to identify scenarios you want to detect (for the correlation), check you want to do (for compliance), and what kind of anomalies you want to identify (for the analytic part).<BR /> So SIEM is just a tool that does not answer all security needs. That said, you might have a look to <A href="http://docs.splunk.com/Documentation/ES">ES documentation</A> and look for .conf presentation for real use case.</P> Mon, 09 May 2016 08:18:43 GMT mdessus_splunk 2016-05-09T08:18:43Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Learning-SIEM-basics/m-p/241152#M1644 <P>Hello,</P> <P>I now have fairly good experience with Splunk and want to learn more about SIEM but not sure where to start. I am from application side and have handled various applications in the past. I want to learn SIEM basics so that I have good idea when dealing with Splunk SIEM.</P> <P>Any help or pointer is greatly appreciated.</P> <P>Thanks<BR /> Hemendra</P> Mon, 09 May 2016 08:02:56 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Learning-SIEM-basics/m-p/241152#M1644 hemendralodhi 2016-05-09T08:02:56Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Learning-SIEM-basics/m-p/241153#M1645 <P>My advice: do not think about product, but think about your needs: what are the risk for your company, mainly the business ones ?<BR /> Then, you will be able to identify scenarios you want to detect (for the correlation), check you want to do (for compliance), and what kind of anomalies you want to identify (for the analytic part).<BR /> So SIEM is just a tool that does not answer all security needs. That said, you might have a look to <A href="http://docs.splunk.com/Documentation/ES">ES documentation</A> and look for .conf presentation for real use case.</P> Mon, 09 May 2016 08:18:43 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Learning-SIEM-basics/m-p/241153#M1645 mdessus_splunk 2016-05-09T08:18:43Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Learning-SIEM-basics/m-p/241154#M1646 <P>Thanks mdessus for your input. I will follow above tip.</P> Tue, 10 May 2016 00:31:53 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Learning-SIEM-basics/m-p/241154#M1646 hemendralodhi 2016-05-10T00:31:53Z