topic i need few usecases in Splunk Search

i need few usecases

thaheseens — Tue, 28 Apr 2020 09:02:41 GMT

PII Leaked
DNS Generator Anomaly
Encrypted C and C
Command Anomaly
Command and Control Repudation Anomaly
File Action Anomaly
PowerShell Remote Access
SQL Shell Command

Re: i need few usecases

to4kawa — Tue, 28 Apr 2020 09:12:18 GMT

https://blogs.jpcert.or.jp/en/2017/09/chase-up-datper-bba7.html
https://splunkbase.splunk.com/app/3435/

Re: i need few usecases

DavidHourani — Tue, 28 Apr 2020 09:35:49 GMT

hi @thaheseens,

Here you go, lots of usecases to see here :

ES Dashboards :
https://docs.splunk.com/Documentation/ES/6.1.0/User/Overview

ES Content Update :
https://splunkbase.splunk.com/app/3449/#/details
List of usecases here :
https://docs.splunk.com/Documentation/ESSOC/1.0.52/stories/UseCase

SSE :
https://splunkbase.splunk.com/app/3435/#/details
List of usecases here :
https://docs.splunksecurityessentials.com/content-detail/

Hope this helps !

Cheers,
David