Alerting

What are Splunk SOC rules?

VijaySrrie
Builder

Hi All,

Please help me with the splunk alerts for below scenario

 

Thanks,

Vijay Sri S

Labels (1)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Hi @VijaySrrie ,

 

You can take reference from these:

 

Actually, this is not the list of scenarios, actually to achieve one of the items you listed here you may require to implement many alerts.

For example,  to implement the "Criminals gain access to the platform and install Ransomware that disrupts platform" scenario, there are many sample searches already provided here - https://research.splunk.com/stories/ransomware/ And you can make countless more.

 

But, I'm happy to hear from others who have better security experience than me to find out if there is a quicker way to go about this.🤔


I hope this helps!!! 

SOC is not installation but rather a journey.!!!!

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Hi @VijaySrrie ,

 

You can take reference from these:

 

Actually, this is not the list of scenarios, actually to achieve one of the items you listed here you may require to implement many alerts.

For example,  to implement the "Criminals gain access to the platform and install Ransomware that disrupts platform" scenario, there are many sample searches already provided here - https://research.splunk.com/stories/ransomware/ And you can make countless more.

 

But, I'm happy to hear from others who have better security experience than me to find out if there is a quicker way to go about this.🤔


I hope this helps!!! 

SOC is not installation but rather a journey.!!!!

VijaySrrie
Builder
 
 
Criminals gain access to the platform and install Ransomware that disrupts platform
An employee deliberately or accidentally misusing their access to PII records
Denial of service attack by criminals or state-sponsored actors flooding cloud resources, causing platform to become unavailable and inaccessible.
Supply chain security is compromised and Ovo loses access to services it is provided
Ineffective controls on endpoint devices, enabling unauthorised access by criminals or state-sponsored actors
Criminals gain access to underlying cloud infrastructure and steal PII data
Criminals gain access to exposed APIs and steal PII data
Users could escalate privileges and/or move laterally in the platform to see data they shouldn't
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...