Alerting

Assistance creating alerts

channa_tep
Loves-to-Learn

Hello All
Just got a job with Splunk inheritance, no knowledge about Splunk I could say I'm in the category Splunk for Dummy. what I know is we have

  • Splunk Enterprise
  • Universal forward install on domain controller and other important servers as well. 

Could someone assistance me creating alerts for the following

  1. Excessive Login Failures
  2. Account Added to Security Enabled Group
  3. Event Logs Cleared
  4. Detect Excessive Account Lockouts from Endpoint 
  5. Short Lived Windows Accounts
  6. Windows User Account Created/Deleted
  7. Unclean Malware Detected
  8. Disk Utilization Over 95%

thank you very much in advance.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you have no knowledge, go and do Splunk Fundamentals 1

https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html

It's a free course and will give you basics.

 

0 Karma

channa_tep
Loves-to-Learn

Thank you

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I would probably suggest starting with the Splunk Security Essentials app to discover use cases you can meet in your environment with the data you have ingested in Splunk.

It is well documented and should be very helpful, especially since you have limited Splunk experience.

You might also find some nuggets here.

0 Karma

channa_tep
Loves-to-Learn

Thank you, I will look into it

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

There's also a couple of free fundamentals training classes available here, fyi.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...