All Apps and Add-ons

Where is the documentation on how to use the Verizon Data Breach Investigations Report (DBIR) app for Splunk?

mendesjo
Path Finder

Ok I installed the app, now what? I have some pretty pull down menus... what do you do next?

0 Karma

nnmiller
Contributor

Per jkat54 on question 257867, please have a look at:

$SPLUNK_HOME/etc/apps/DBIR_splunk_app/appserver/static/html/dbir_help_basic.html

Also, similar to Enterprise Security, the PCI app for Splunk, and ITSI, your data will need to be normalized to conform to the Common Information Model (CIM) to integrate with DBIR. More information on CIM can be found here: Common Information Model Add-on Manual. CIM app

0 Karma

mendesjo
Path Finder

Thanks for the reply. So, does this app somehow coorelate existing data in my splunk environment with Verizon's data? How will it obtain the Verizon information, does it down load it somehow?

0 Karma

nnmiller
Contributor

Based on this press release, and looking at the app, it appears using the DBIR historical data which is contained within the application itself.

There are more HTML help files in that html directory I mentioned in my answer.

If you are not familiar with CIM, then I strongly suggest you read the CIM documentation before going further with this app, since understanding how to normalize data (source typing, event types, tags), is essential.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...