Assistance creating alerts

[channa_tep]

Hello All
Just got a job with Splunk inheritance, no knowledge about Splunk I could say I'm in the category Splunk for Dummy. what I know is we have

• Splunk Enterprise
• Universal forward install on domain controller and other important servers as well. 

Could someone assistance me creating alerts for the following

1. Excessive Login Failures
2. Account Added to Security Enabled Group
3. Event Logs Cleared
4. Detect Excessive Account Lockouts from Endpoint 
5. Short Lived Windows Accounts
6. Windows User Account Created/Deleted
7. Unclean Malware Detected
8. Disk Utilization Over 95%

thank you very much in advance.

[bowesmana]

If you have no knowledge, go and do Splunk Fundamentals 1

https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html

It's a free course and will give you basics.

[channa_tep]

Thank you

[s2_splunk]

I would probably suggest starting with the Splunk Security Essentials app to discover use cases you can meet in your environment with the data you have ingested in Splunk.

It is well documented and should be very helpful, especially since you have limited Splunk experience.

You might also find some nuggets here.

[channa_tep]

Thank you, I will look into it

[s2_splunk]

There's also a couple of free fundamentals training classes available here, fyi.