All Apps and Add-ons

Differences between Enterprise Security and Security Essentials ?

Esky73
Builder

For an organisation that already has Splunk ES - what are the differences between the two products - will installing SE (or inc SE for ransomware) compliment ES and provide additional insights ?

1 Solution

esix_splunk
Splunk Employee
Splunk Employee

It depends on how active you and your teams use Splunk. ES is a fully fledged application designed around event correlation, management, and response.

The Security Essentials toolkits is more focused on specific use cases.

In my experience they compliment each other very well. In fact, once fully understood, searches out of the SE toolkit can be migrated into ES and adopted.

So use both!

But, dont put them on the same search head / SHC!

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

It depends on how active you and your teams use Splunk. ES is a fully fledged application designed around event correlation, management, and response.

The Security Essentials toolkits is more focused on specific use cases.

In my experience they compliment each other very well. In fact, once fully understood, searches out of the SE toolkit can be migrated into ES and adopted.

So use both!

But, dont put them on the same search head / SHC!

View solution in original post

Esky73
Builder

Thanks for the info looks like a great approach - however having now investigated further - its suggested that they can co-exist on the same SH as they only run searches once a day and they can be scheduled OOH.

Also when only one SH is available (very small deployment of 25GB p\d) ..

0 Karma

David
Splunk Employee
Splunk Employee

+1 to the once per day. Should be an easy win for most of the SSE searches. And you can even save searches from SSE directly as ES correlation searches from the app! 🙂

esix_splunk
Splunk Employee
Splunk Employee

With that small of a deployment, you should be ok. But just be aware of the searches and resource utilization..

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.