Getting Data In

Cisco/OpenDNS Umbrella/Investigate: so many apps, so many options ... What is best?

Esteemed Legend

Here is what is on Splunkbase (maybe others, too):
Umbrella Add-on for Splunk Enterprise: (also on GitHub)
Cisco Umbrella Add-On for Splunk:
Cisco Umbrella Investigate Add-on:
Cisco Cloud Security Umbrella Add-on for Splunk:

There is clearly a great deal of duplication and I am VERY confused about what is what and which to use.
There are at least 2 things to be done:
1: Data Input: Pull in security events.
2: Ad-Hoc Lookup: Enrich Splunk events with threat detail.

I am hoping for 2 kinds of help:
1: A suggestion on which apps to use.
2: Step-by-step details on how to set each up.

Labels (1)

Loves-to-Learn Lots

Hey, did you ever set investigate up? 

I have umbrella logs going to our s3 buckit and pulling that data in with the cisco cloud security umbrella addon.

Not really sure if I need to fully setup cisco cloud security app. This is the app found in the github presentation. Thanks.  

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...