All Apps and Add-ons

How to Use InfoSec App for Splunk

maangellamatini
Explorer

My team is fairly new in the cybersecurity industry and our manager would like us to make a brief presentation about the InfoSec App and how we can utilize it in Splunk. We tried searching everywhere but material regarding this can't be seen by just browsing online (I'm aware that we need to test it itself). We are beginners in Splunk and we're having a hard time populating it with data models. Any tips on where we can find meaningful data to test it out? Or if we have an antivirus program, how can we connect it to Splunk and the InfoSec app itself? Would really appreciate guidance on this.

Tags (1)
1 Solution

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @maangellamatining, the InfoSec app uses core capabilities of the Splunk platform. Once you familiarize yourself with Splunk and start sending data to Splunk, installing the InfoSec app will be simple.

You will find many free resources to get you going with Splunk. Here are some:

Free Splunk download:
www.splunk.com/download

How-to videos:
www.splunk.com/view/education-videos/SP-CAAAGB6

Free on-demand eLearning course:
https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html

For best results with the InfoSec app, you would want to send the following data to Splunk:

  • Firewall data like Cisco ASA, Palo Alto Networks, Check Point, Juniper, Fortinet, etc.
  • Active Directory security logs (make sure that your audit policy enables logging failed and successful authentication attempts)
  • Antivirus/Malware data like McAfee, Symantec, Trend Micro, etc.

View solution in original post

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @maangellamatining, the InfoSec app uses core capabilities of the Splunk platform. Once you familiarize yourself with Splunk and start sending data to Splunk, installing the InfoSec app will be simple.

You will find many free resources to get you going with Splunk. Here are some:

Free Splunk download:
www.splunk.com/download

How-to videos:
www.splunk.com/view/education-videos/SP-CAAAGB6

Free on-demand eLearning course:
https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html

For best results with the InfoSec app, you would want to send the following data to Splunk:

  • Firewall data like Cisco ASA, Palo Alto Networks, Check Point, Juniper, Fortinet, etc.
  • Active Directory security logs (make sure that your audit policy enables logging failed and successful authentication attempts)
  • Antivirus/Malware data like McAfee, Symantec, Trend Micro, etc.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...