Community Office Hours

Wednesday, March 19, 2025

[Register Here] This thread is for the Community Office Hours session on Security: Cisco Talos Integration on Wed, March 19, 2025 at 1pm PT / 4pm ET. This is your opportunity to ask questions about Cisco Talos integration with Splunk Security. Our experts are ready to answer all your questions, such as: What can I ask in this AMA? How does Cisco Talos threat intelligence integrate with Splunk Security products? What kinds of intelligence are provided by the Cisco Talos integrations? How do I start using Cisco Talos intelligence in my Splunk Security products? Anything else you’d like to learn! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (request access here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

Thursday, April 24, 2025

[Register Here ] This thread is for the Community Office Hours session on Security: SOAR on Thur, April 24, 2025 at 1pm PT / 4pm ET. (It is the updated schedule for our event~) This is your opportunity to ask questions related to your specific Splunk SOAR product, and use cases, including: What are the latest features of SOAR that I should know about? How do Splunk SOAR Playbooks and Actions integrate with Splunk Enterprise Security? How can I leverage the Automation Rules feature to assign playbooks to detections and automate the process? What are the best practices for developing playbooks, workbooks, and process workflows? How do I implement Guided Automation to further optimize the playbook-building process? What are the best practices for setting up prompts in SOAR? Anything else you’d like to learn! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (request access here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

2

Wednesday, July 16, 2025

[Register Here] This thread is for the Community Office Hours session on Data Management in Security on Wed, July 16, 2025 at 1pm PT / 4pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What are the best practices for managing and optimizing security data ingestion in Splunk? How can I improve the efficiency of my security data pipelines? How do I properly map security logs to the Common Information Model (CIM)? How to ensure accuracy and consistency with large volumes of data across multiple security log sources? How should I structure my security data for faster investigations and threat hunting? What role does AI/ML play in managing and analyzing security data in Splunk? Anything else you’d like to learn! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (request access here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

Wednesday, August 20, 2025

[Register here] This thread is for the Community Office Hours session on Security: Enterprise Security on Wed, Aug 20, 2025 at 1pm PT / 4pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What are the latest updates in Splunk Enterprise Security? How can I implement Risk-based alerting (RBA)? How can I utilize Threat Intelligence Management and Cisco Talos for better context? How do I access the latest out-of-the box detections? Which Splunkbase apps and add-ons are recommended for Splunk Enterprise Security use cases? Anything else you’d like to learn! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (request access here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

Tuesday, November 18, 2025

[Register Here] This thread is for the Community Office Hours session on Splunk Enterprise Security - the AI Powered SecOps Platform on Tuesday, Nov 18, 2025 at 11 am PT / 2 pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What is different in the latest Splunk Enterprise Security, the AI powered SecOps Platform? Why upgrade to Enterprise Security 8 and why now? What are upgrade considerations and prep work? What do I need to know as a SOC Analyst, Detection Engineer, or SOAR engineer before and after my upgrade to Enterprise Security 8? What is the difference between Enterprise Security Essentials and Enterprise Security Premier? Anything else you'd like to learn! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

1

Wednesday, December 10, 2025

[Register Here] This thread is for the Community Office Hours session on Security: Splunk SOAR on Wednesday, Dec 10, 2025 at 11 am PT / 2 pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What’s new in the latest Splunk SOAR? Should I upgrade to this version, and what’s the easiest way to make the upgrade happen? How does the Splunk Attack Analyzer integration work? And how can playbooks be implemented to automate response processes for the malware and phishing attack? What are the practical ways to modernize legacy SOC workflows with Splunk Enterprise Security and build the TDIR workflow. How to use Wayfinder? How to measure the value of my SOAR investment? Real-world examples of how SOAR enhancements improved efficiency, security, and ROI? Anything else you’d like to learn! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

1

Wednesday, January 21, 2026

[Register Here] This thread is for the Community Office Hours session on Security: Splunk Threat Research Team - Security Content AMA on Wednesday, Jan 21, 2026 at 11 am PT / 2 pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What are the latest security content updates from the Splunk Threat Research Team? What are the best practices for implementing the Splunk Technology Add-on for Ollama? What tips and tricks can help leverage Splunk Attack Range, Contentctl, and other resources developed by the Splunk Threat Research Team? What new analytic stories and detections can surface AI-enabled workflows to help you detect and respond to emerging threats across critical enterprise platforms? How do the detections work across the integration between Cisco Talos and Splunk? Any specific questions you have when you leverage the out-of-box-detections? Any other questions about the team’s content and resources! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

1

Wednesday, February 18, 2026

[Register Here ] This thread is for the Community Office Hours session on Security: Insider Threats on Wednesday, Feb 18, 2026 at 11 am PT / 2 pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What are the most common insider threats today, and what are the typical indicators associated with them? What are the key considerations when detecting and analyzing insider threats? What are the best practices for detecting and investigating insider threats using Splunk? How can I maximize the use of threat intelligence and contextual insights when investigating insider threats? How can I best leverage data from Splunk to understand insider threat trends? How can machine learning and AI be used to scale your analytics? Can you provide insights on how User and Entity Behavior Analytics (UEBA) helps detect insider threats? How does the risk scoring work? Any other questions about the team’s content and resources! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

Wednesday, March 18, 2026

[Register Here] This thread is for the Community Office Hours session on Security: Enterprise Security Essentials and Enterprise Security Premier on Wednesday, March 18, 2026 at 11 am PT / 2 pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What is available in Splunk Enterprise Security (ES) Premier that is not available in Splunk Enterprise Security (ES) Essentials? What makes ES Essentials better than ES 7.X? What new or improved use cases should I expect ES Premier to help me deliver? What should I consider or prepare if I’m currently using ES Essentials and planning to migrate to ES Premier? What will happen to my dashboards, configurations, and investigations if I upgrade from ES Essentials to ES Premier? What sort of education or professional services are available for me to build an expert practice in ES Essentials or ES Premier? What does the SOAR integration look like for ES Essentials and ES Premier? How does UEBA integrate with ES Premier? Anything else you’d like to learn! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

1

Wednesday, April 22, 2026

[Register Here] This thread is for the Community Office Hours session on Security: Splunk AI in Security AMA on Wednesday, April 22, 2026 at 11 am PT / 2 pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. What can I ask in this AMA? What are best practices for leveraging the AI Toolkit and AI Assistant in Security? What are some key benefits? What are some of the best approaches for leveraging Splunk's AI capabilities with my existing security workflows? How can investigations be streamlined with the AI Assistant in Security? How can Splunk's AI capabilities for security accelerate advanced threat detection and response? How can Splunk's AI offerings help support custom security use cases? Is a separate license required for Splunk's AI for security capabilities? Are there any resources or training programs available to help teams adopt Splunk AI in security? Anything else you’d like to learn? Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

Wednesday, May 20, 2026

[Register Here] This thread is for the EMEA Community Office Hours session on Enterprise Security Essentials & Premier on Wednesday, May 20, 2026 at 10 am BST / 11 am CEST. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics. While this session is scheduled as an EMEA office hour for time zone convenience, it is open to everyone—if the time works for you, we’d love to have you join us. What can I ask in this AMA? What is available in Splunk Enterprise Security (ES) Premier that is not available in Splunk Enterprise Security (ES) Essentials? What makes Enterprise Security Essentials better than ES 7.X? What new or improved use cases should I expect Premier to help me deliver? What should I consider or prepare if I’m currently using ES Essentials and planning to migrate to ES Premier? What will happen to my dashboards, configurations, and investigations if I upgrade from ES Essentials to ES Premier? What sort of education or professional services are available for me to build an expert practice in ES Essentials or ES Premier? What does the SOAR integration look like for ES Essentials and ES Premier? How does UEBA integrate with ES Premier? Anything else you’d like to learn! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. Look forward to connecting!

0 attendees

0

Wednesday, July 29, 2026

[Register here] Join our interactive Detection Engineering office hours for direct, actionable guidance from the experts who manage our internal security operations. Bring your toughest challenges—from broken detections to architectural hurdles—and let’s get you to production-ready. Focus Areas Detection Tuning: Reduce false positives. Coverage Mapping: Align with MITRE ATT&CK. Automation: Build repeatable CI/CD pipelines. Advanced Alerting: Surface complex attack patterns. AI Integration: Accelerate content with high-fidelity context. How to Participate Submit Your Questions (Optional): While not required, we encourage you to submit your scenarios during registration. Pre-submitted questions are prioritized. Join the Discussion: Connect with us in the #office-hours Slack channel. Live Q&A: We will open the floor to all participants after addressing pre-submitted topics. Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you!

0 attendees

0

Thursday, October 15, 2026

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to mastering the latest Splunk Enterprise Security innovations. Join us to move from theory to practice as we explore how to defend faster and more autonomously than ever before. Whether you’re looking to get more value from your current deployment or exploring the benefits of ES Premier, this series provides a clear roadmap for your security journey. Review the schedule below and join us for the sessions that best fit your team's needs. [REGISTER HERE] Bring your technical questions to our open forum and get real-world advice on optimizing your Splunk ES deployment. Whether you're tuning detections or exploring the benefits of ES Premier, you'll leave with clear next steps for your security roadmap. Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you!

0 attendees

0

Tuesday, October 20, 2026

[Register HERE]. This thread is for the Community Office Hours session on Federation 2.0: Explore the Latest Capabilities and Offerings on Tuesday, October 20, 2026 at 11am PT / 2pm ET. Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk products and use case topics. In this session, we’ll focus on Federation 2.0 and the latest capabilities and offerings available across Splunk’s federated search portfolio. Join us to learn and explore how capabilities such as Federated Search for Amazon S3, AWS CloudWatch, DDSS, Cisco SAL, Snowflake, Microsoft Azure and Azure Databricks, can help you gain insights from data where it resides. What can I ask in this AMA? What is Federation 2.0 and how has Splunk’s federation offering evolved from Federation 1.0? How do I get started with Federation? How do I determine which federation option is right for my data and use case? How can I search data stored in Amazon S3, Microsoft Azure, Azure Databricks and other data stores What are some common Federation use cases across security, observability, and platform workflows? How can Federation fit into a broader data management and data strategy? Anything else you’d like to learn about Federation! Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (sign in with SSO here) Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you!

0 attending

0

Thursday, November 5, 2026

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC transformation is not just about adding AI. It is about knowing where to apply autonomy, when to keep humans in the loop, and how to build trust through evidence, approvals, rollback, auditability, and accountability. 👉 [REGISTER HERE] 👈 A consultative forum for attendees to discuss their Agentic SOC roadmap, maturity gaps, and next best steps. Sessions can use anonymized scenarios or ad-hoc questions to preserve confidentiality. Please submit your questions at registration. You can also head to the #office-hours Community Slack channel to ask questions (sign-in with SSO here). Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants. We look forward to connecting with you!

0 attending

0

Community Office Hours

Join the Conversation

Community Office Hours