How to Use InfoSec App for Splunk

[maangellamatini]

My team is fairly new in the cybersecurity industry and our manager would like us to make a brief presentation about the InfoSec App and how we can utilize it in Splunk. We tried searching everywhere but material regarding this can't be seen by just browsing online (I'm aware that we need to test it itself). We are beginners in Splunk and we're having a hard time populating it with data models. Any tips on where we can find meaningful data to test it out? Or if we have an antivirus program, how can we connect it to Splunk and the InfoSec app itself? Would really appreciate guidance on this.

[igifrin_splunk · Accepted solution]

Hi @maangellamatining, the InfoSec app uses core capabilities of the Splunk platform. Once you familiarize yourself with Splunk and start sending data to Splunk, installing the InfoSec app will be simple.

You will find many free resources to get you going with Splunk. Here are some:

Free Splunk download:
www.splunk.com/download

How-to videos:
www.splunk.com/view/education-videos/SP-CAAAGB6

Free on-demand eLearning course:
https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html

For best results with the InfoSec app, you would want to send the following data to Splunk:

• Firewall data like Cisco ASA, Palo Alto Networks, Check Point, Juniper, Fortinet, etc.
• Active Directory security logs (make sure that your audit policy enables logging failed and successful authentication attempts)
• Antivirus/Malware data like McAfee, Symantec, Trend Micro, etc.