https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301647#M2672 <P>I have no experience and I need to set up a SOC/NOC with Splunk. Thank you for andurstanding me and helping me.</P> Tue, 04 Apr 2017 08:07:21 GMT mbdiameth 2017-04-04T08:07:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301647#M2672 <P>I have no experience and I need to set up a SOC/NOC with Splunk. Thank you for andurstanding me and helping me.</P> Tue, 04 Apr 2017 08:07:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301647#M2672 mbdiameth 2017-04-04T08:07:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301648#M2673 <P>A SOC and NOC are a combination of tools, processes, people.<BR /> Splunk can be the tool for collecting data (logs, metrics, networks streams...) in order to monitor availability/performance and security (correlation, analytics, fraud...). It will be also a great tool for investigation in both cases.</P> Tue, 04 Apr 2017 11:39:52 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301648#M2673 mdessus_splunk 2017-04-04T11:39:52Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301649#M2674 <P>Hi,</P> <P>There is a book that describes generic principles about how to deploy a central big data SIEM (in reality Splunk) that is hard of SOC.<BR /> Crafting the Infosec - <A href="http://shop.oreilly.com/product/0636920032991.do">http://shop.oreilly.com/product/0636920032991.do</A>. It's written by Cisco CSIRT team members.</P> <P>Tomas</P> Tue, 04 Apr 2017 11:50:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301649#M2674 tomasmoser 2017-04-04T11:50:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301650#M2675 <P>Did you take a look at</P> <P><A href="https://www.splunk.com/pdfs/technical-briefs/building-a-soc-with-splunk-tech-brief.pdf">https://www.splunk.com/pdfs/technical-briefs/building-a-soc-with-splunk-tech-brief.pdf</A></P> <P>Or</P> <P><A href="https://www.slideshare.net/Splunk/sl-2015-houstonbuildingsocherrald">https://www.slideshare.net/Splunk/sl-2015-houstonbuildingsocherrald</A></P> <P>There are lots of resources online but you can't summarise a several months or years job in one answer I'm afraid.<BR /> My only advice if you don't have the experience would be to hire someone with that experience first and then start from that.</P> <P>Thanks,<BR /> J</P> Tue, 04 Apr 2017 11:52:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301650#M2675 javiergn 2017-04-04T11:52:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301651#M2676 <P>Thank you for this precious help to enlighten me</P> Wed, 05 Apr 2017 17:47:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301651#M2676 mbdiameth 2017-04-05T17:47:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301652#M2677 <P>Thank you for this precious help to enlighten me</P> Wed, 05 Apr 2017 17:48:56 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301652#M2677 mbdiameth 2017-04-05T17:48:56Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301653#M2678 <P>Thank you for this precious help to enlighten me</P> Wed, 05 Apr 2017 17:49:36 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-set-up-a-SOC-with-Splunk/m-p/301653#M2678 mbdiameth 2017-04-05T17:49:36Z