Alerting

splunk enterprise security

trojan_81
Path Finder

Hi Splunk Experts,

Suppose I only have splunk cloud.  Is it NOT possible to set an alert based on a search that correlates events from multiple systems? Such as correlating an event across endpoint and network activity.  Is this where Enterprise Security is needed? Or is the answer that one can technically do it without Enterprise security but it would be tougher?

Would splunk enterprise have more out of the box correlations than just splunk cloud?

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You do not need Enterprise Security to correlate events from multiple systems or sources.  Using ES would not necessarily make it easier.

Splunk Cloud and Splunk Enterprise have the same set of OOTB correlations.

---
If this reply helps you, Karma would be appreciated.
0 Karma

trojan_81
Path Finder

That helps greatly thank you.  With that in mind, what are a few reasons why you would want to implement ES  (assume you had the funds)?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check out the Splunk Security Essentials and ES Content Update apps for some example use cases that are best (or only) implemented using ES.

Also, ES has built-in features that enrich the assets and identities in your data.

That's not to mention the support for investigations and other SIEM features.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...