All Apps and Add-ons

Modify/Add detection rules in Splunk Security Essentials

zzehour
New Member

Hello,

I would like to modify some use cases provided by default in SSE, i tried to do it via the gui but it doesn't work.
When browsing app files, i noticed that cases information is stored in multiple json files which i tried to modify but this didn't changed in the gui. Is there any way to do it ?

Also, i tried to add custom content, it is possible from the gui but i have many rules to add, is there any file (like savedsearch.conf for example) that enables loading all the rules and other components like the MITRE, description at once unstead of doing it one by one in the gui ?

Thank you

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One does not modify the queries SSE. They're just examples, anyway. Copy the queries into your own app and make your changes there.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One does not modify the queries SSE. They're just examples, anyway. Copy the queries into your own app and make your changes there.

---
If this reply helps you, Karma would be appreciated.
0 Karma

fahmed11
Explorer

There are cases where Splunk Essentials is not able to find the data using the pre-configured Data Source Check queries. Are you saying that the solution to that is to replicate the whole application and make changes there? Maybe that's not exactly throwing the wheel away and starting all over again, but it seems pretty close.

0 Karma

zzehour
New Member

Thank you for the answer !

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...