topic Splunk Enterprise Security Content Update and ES documentation inconsequence in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Content-Update-and-ES-documentation/m-p/513696#M9122 <P>User Guide for ESCU version 3.0.5 (<A href="https://docs.splunk.com/Documentation/ESSOC/3.0.5/user/ConfigureSplunkEnterpriseSecurity(ES)touseMLTK" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/ESSOC/3.0.5/user/ConfigureSplunkEnterpriseSecurity(ES)touseMLTK</A>) refers to ES User Guide version 5.2.2 (<A href="https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention</A>) on how to install Custom Apps, in this case MLTK.&nbsp;</P><P>The problem is, the same ES User Guide for current ES version (6.2.0) does not exist. I tried to follow the ESCU guide and configure "App Imports Update" but was unable to edit "update_es" input.</P><P>Shouldn't this be updated? What is the correct configuration of MLTK for ESCU?</P> Wed, 12 Aug 2020 11:43:35 GMT alekwisnia 2020-08-12T11:43:35Z Splunk Enterprise Security Content Update and ES documentation inconsequence https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Content-Update-and-ES-documentation/m-p/513696#M9122 <P>User Guide for ESCU version 3.0.5 (<A href="https://docs.splunk.com/Documentation/ESSOC/3.0.5/user/ConfigureSplunkEnterpriseSecurity(ES)touseMLTK" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/ESSOC/3.0.5/user/ConfigureSplunkEnterpriseSecurity(ES)touseMLTK</A>) refers to ES User Guide version 5.2.2 (<A href="https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention</A>) on how to install Custom Apps, in this case MLTK.&nbsp;</P><P>The problem is, the same ES User Guide for current ES version (6.2.0) does not exist. I tried to follow the ESCU guide and configure "App Imports Update" but was unable to edit "update_es" input.</P><P>Shouldn't this be updated? What is the correct configuration of MLTK for ESCU?</P> Wed, 12 Aug 2020 11:43:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Content-Update-and-ES-documentation/m-p/513696#M9122 alekwisnia 2020-08-12T11:43:35Z Re: Splunk Enterprise Security Content Update and ES documentation inconsequence https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Content-Update-and-ES-documentation/m-p/513709#M9123 Enterprise Security doesn't have the app import feature in version 6+. Apps are imported based on their security settings like with other Splunk apps.<BR />Also, ES uses MLTK by default so there's no need to configure it to do so. Wed, 12 Aug 2020 12:18:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-Content-Update-and-ES-documentation/m-p/513709#M9123 richgalloway 2020-08-12T12:18:07Z