topic Re: How does Splunk Enterprise Security work? in Splunk Enterprise Security

How does Splunk Enterprise Security work?

neermine — Sat, 25 Aug 2018 20:42:15 GMT

hello

I want to understand the concept of how Splunk security works.
I think that it has a database of signatures of threat and when we enter the logs, it does the pattern matching. Is that right?

Re: How does Splunk Enterprise Security work?

David — Mon, 27 Aug 2018 18:20:58 GMT

Hi neermine,

Splunk is a platform for analyzing machine generated data of all kinds from server logs to even metadata about network communications. The analysis can include simple pattern matching, behavioral analytics (spikes and newness), machine learning, and more.

To get a good sense, I'd recommend you walk through some of our examples that show how Splunk works with Security including:

The Essential Guide to Security (ebook)
Security Investigation Workflow - click Try Now on that page to get access to a guided workflow showing how Splunk is used by SOCs
Security Datasets Project - a similar guided walk through advanced datasets.
Or just download it yourself and try with your own data for free. Consider apps like Splunk Security Essentials.

If you ever need more, don't hesitate to reach out to our sales org for help.

Re: How does Splunk Enterprise Security work?

neermine — Mon, 27 Aug 2018 20:51:59 GMT

thanks 🙂

Re: How does Splunk Enterprise Security work?

markdennett — Tue, 19 Mar 2019 15:51:50 GMT

Hi,

Can you tell me if this uses machine learning decision tree techniques specifically? Thanks