https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/476476#M7519 <P>Yes, kind of it. We increase the risk score of an asset based on the severity of Darktrace alerts. As example, If host A has an alert that is HIGH or CRITICAL in darktrace, we would also increase risk score for host A on ES.</P> Wed, 26 Feb 2020 14:10:34 GMT alonsocaio 2020-02-26T14:10:34Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/476473#M7516 <P>Hi,</P> <P>Can anybody helpme to get some use cases for darktrace. Right now I am looking only for score value.</P> Wed, 19 Feb 2020 15:26:47 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/476473#M7516 pradeep577 2020-02-19T15:26:47Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/476474#M7517 <P>Hey,</P> <P>I am also using Splunk ES and Darktrace. We created a correlation search to create notables when Darktrace alerts logged into Splunk. </P> <P>It helped us on correlating the darktrace alerts with our assets and identities lists from ES, increasing risk score of users and systems based on Darktrace alerts score.</P> <P>Also, you should take a look at Darktrace Connector for Splunk: (<A href="https://splunkbase.splunk.com/app/3539/">https://splunkbase.splunk.com/app/3539/</A>)</P> Sat, 22 Feb 2020 13:03:17 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/476474#M7517 alonsocaio 2020-02-22T13:03:17Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/476475#M7518 <P>Thank you for your response.<BR /> So you are saying you are looking at the assets list on ES and mapping it to DT alerts.</P> Sat, 22 Feb 2020 20:22:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/476475#M7518 pradeep577 2020-02-22T20:22:16Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/476476#M7519 <P>Yes, kind of it. We increase the risk score of an asset based on the severity of Darktrace alerts. As example, If host A has an alert that is HIGH or CRITICAL in darktrace, we would also increase risk score for host A on ES.</P> Wed, 26 Feb 2020 14:10:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/476476#M7519 alonsocaio 2020-02-26T14:10:34Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/703192#M12158 <P>Hi,</P><P>I'm struggling to get our security tools alerts (eg., Darktrace, Palo alto) to ES in notable events wherein our security analysts can go in look for all alerts and have a view of single pan of glass.</P><P>Could you please assist me how you&nbsp;<SPAN>configured a correlation search to create notables when Darktrace alerts logged into Splunk?</SPAN></P><P><SPAN>Many thanks in advance!</SPAN></P> Wed, 30 Oct 2024 18:43:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Any-use-cases-for-darktrace/m-p/703192#M12158 cyber_geek 2024-10-30T18:43:01Z