This is information I'm always curious to know about other people's environments/setups.
Is there anything you're particularly proud of that you set up? Some super novel dashboard, or really innovative alert or way of thinking about how you've logged or ingested logs? I'm pretty aware of most of the ways in which we use Splunk, but know there's gotta be cool stuff out there I've never thought of.
Sorry if this question's been asked in a different form, I couldn't find a great example of it!
In one project we rebuilt an ArcSight SIEM
implementation completely in core Splunk.
In another project we completely rebuilt ITSI
in core Splunk.
In another project we built a threshold setting/checking tool that used text
fields as both input and output that tracked user changes and could revert the previous changes to a particular date (again, all in core Splunk).
As a personal exercise I rebuilt all of fail2ban
in core Splunk.
We built a near-realtime Least-Cost-Routing
tool back when VIOP
was ex$pen$ive that saved our company hundreds of thousands of dollars every day.
Happy New Year All..
Can you elaborate more on the rebuild of ArcSight SIEM implementation in core Splunk?