All Apps and Add-ons

Is there a list with recommended indexes for Security Essentials?

dersa
Path Finder

Hi, 

is there a list with recommended indexes for Security Essentials? I have to build a PoC in a greenfield deployment and would like to create the indexes in a way that they are also usable in Enterprise Security.

thanks

Alex

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Enterprise Security has a few required indexes, which you can find in the installation instructions.  SSE, however, has neither required nor recommended indexes.  That's because it and ES use *your* indexes where *you* choose to store *your* data in a way that makes the most sense to *you*.  If the data is onboarded in CIM-compliant ways and properly tagged then ES will find it.  In SSE, just edit the searches to use your index names (it's not a Production tool, anyway).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Enterprise Security has a few required indexes, which you can find in the installation instructions.  SSE, however, has neither required nor recommended indexes.  That's because it and ES use *your* indexes where *you* choose to store *your* data in a way that makes the most sense to *you*.  If the data is onboarded in CIM-compliant ways and properly tagged then ES will find it.  In SSE, just edit the searches to use your index names (it's not a Production tool, anyway).

---
If this reply helps you, Karma would be appreciated.

dersa
Path Finder

Thanks Rich!

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...