Does anyone have a document/steps to guide me to do a SIEM migration from Qradar to Splunk?

[alexinkedia1]

Does anyone have a document/steps to guide me to do a SIEM migration from Qradar to Splunk

[gcusello]

Hi @alexinkedia1,

as @richgalloway said, this is a job for Splunk Professional Services or for a Splunk Architect, specialized on Enterprise Security, that already did it.

There isn't any available documentation, only the knowledge of the ones who did it.

For the migration of the Correlation Searches, you can find a very useful tool at https://uncoder.io/ and https://github.com/SigmaHQ/sigma 

Ciao.

Giuseppe

[richgalloway]

That usually involves a Professional Services engagement.  It's not a simple task and Splunk has no public documentation on it.