topic Re: Assistance creating alerts in Alerting

Assistance creating alerts

channa_tep — Wed, 15 Sep 2021 21:53:11 GMT

Hello All
Just got a job with Splunk inheritance, no knowledge about Splunk I could say I'm in the category Splunk for Dummy. what I know is we have

Splunk Enterprise
Universal forward install on domain controller and other important servers as well.

Could someone assistance me creating alerts for the following

Excessive Login Failures
Account Added to Security Enabled Group
Event Logs Cleared
Detect Excessive Account Lockouts from Endpoint
Short Lived Windows Accounts
Windows User Account Created/Deleted
Unclean Malware Detected
Disk Utilization Over 95%

thank you very much in advance.

Re: Assistance creating alerts

s2_splunk — Wed, 15 Sep 2021 22:13:51 GMT

I would probably suggest starting with the Splunk Security Essentials app to discover use cases you can meet in your environment with the data you have ingested in Splunk.

It is well documented and should be very helpful, especially since you have limited Splunk experience.

You might also find some nuggets here.

Re: Assistance creating alerts

channa_tep — Wed, 15 Sep 2021 22:15:17 GMT

Thank you, I will look into it

Re: Assistance creating alerts

s2_splunk — Wed, 15 Sep 2021 22:25:29 GMT

There's also a couple of free fundamentals training classes available here, fyi.

Re: Assistance creating alerts

bowesmana — Wed, 15 Sep 2021 23:36:32 GMT

If you have no knowledge, go and do Splunk Fundamentals 1

https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html

It's a free course and will give you basics.

Re: Assistance creating alerts

channa_tep — Thu, 16 Sep 2021 14:47:52 GMT

Thank you