Hardware Appliance Reference Architecture SPLUNK

[tuts]

Environment requirements according to best practices for large companies in Splunk, installing Splunk ES in it, activating more than 10,000roal, and connecting 4,000 devices. What are the best requirements for RAM, CPU, and storage?

[gcusello]

Hi @tuts ,

this is a design job for a Certified Splunk Architectnot for the Community!

anyway, there are other parameters to consider:

• volume of data to daily index,
•  number of Correlation Search,
• number of users,
• HA both on Indexers and Search Heads,
• DR yes or not (multisite clustering).

Ciao.

Giuseppe

[tuts]

 Ok, why when I do the threat type endpoint and high, it considers it threat and low. What is the problem? I hope for an answer.

[gcusello]

Hi @tuts ,

probably you have to tune your Correlation Search, but this seems to be a different question.

Ciao.

Giuseppe

[tuts]

I set the alart to High and security Domaiin = Network, but it appears to me in the Incident Review interface that it is low and security Domaiin = threat, and every event is classified like this, as shown in the attached images.  

  

[gcusello]

Hi @tuts ,

there's something wrong in your proceduree, review it step by step, and follow a Splunk Enterprise Security User / Admin training.

Ciao.

Giuseppe