https://community.splunk.com/t5/Splunk-Enterprise-Security/Simulation-data-for-ESCU/m-p/438814#M5842 <P>Is it possible to get some simulation data for ESCU? Right now all searches just return nothing for our instance. </P> <P>Or how can we use makeresults to generate some simulation data for ESCU?</P> <P>Thank you very much for your help!</P> Mon, 17 Dec 2018 20:31:28 GMT ibmresilient 2018-12-17T20:31:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Simulation-data-for-ESCU/m-p/438814#M5842 <P>Is it possible to get some simulation data for ESCU? Right now all searches just return nothing for our instance. </P> <P>Or how can we use makeresults to generate some simulation data for ESCU?</P> <P>Thank you very much for your help!</P> Mon, 17 Dec 2018 20:31:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Simulation-data-for-ESCU/m-p/438814#M5842 ibmresilient 2018-12-17T20:31:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Simulation-data-for-ESCU/m-p/438815#M5843 <P>if you use the ESCU 2.0 onwards, you can navigate to the 'Analytic Story Detail' menu, select a story and submit 'Configure in ES'. This will create/enable required correlation search. You would need to ensure the sourcetype used etc..is matching with your implementation (or adjust/update it as per your env).</P> Wed, 09 Jan 2019 16:00:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Simulation-data-for-ESCU/m-p/438815#M5843 lakshman239 2019-01-09T16:00:55Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Simulation-data-for-ESCU/m-p/438816#M5844 <P>Sorry, could you pls tell me what is ESCU?</P> Wed, 09 Jan 2019 23:57:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Simulation-data-for-ESCU/m-p/438816#M5844 cyber_castle 2019-01-09T23:57:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Simulation-data-for-ESCU/m-p/438817#M5845 <P>That is the Splunk Enterprise Security Content Update or ESCU, meow details here <BR /> <A href="https://docs.splunk.com/Documentation/ESSOC/latest/user/About">https://docs.splunk.com/Documentation/ESSOC/latest/user/About</A></P> <P>cheers, MuS</P> Thu, 10 Jan 2019 00:15:53 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Simulation-data-for-ESCU/m-p/438817#M5845 MuS 2019-01-10T00:15:53Z