Why is notable index empty?

[NeedNotToKnow]

After installing the Splunk Enterprise Security (ES) app using the splunk-enterprise-security_701.spl file, I noticed that the "Security Posture" dashboard was empty and searching for index=notable returned no results. Upon further investigation, I discovered that there was no inputs.conf file present in the /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/local directory

[gcusello]

Hi @NeedNotToKnow,

before installing and configuring ES, it's a best practice to check that you're receiving all the data flows of your perimeter and that these data flows are all normalized.

You can check normalization checking if the Add-Ons you used to ingest logs are all CIM 4.x compliant.

When you are sure to have all the data flows of your perimeter, you can go in [Configure > Content > Content Management ] and enable the Correlation Searches that you can use with your data flows.

I hint to make a propedeutic analysis on the Correlation Searches that it's possible to enable with your data; you can do this manually or using the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435).

I hint to search in the YouTube Splunk Channel some videos that describe hot to install and configure ES.

Ciao.

Giuseppe

[NeedNotToKnow]

This didn't help

Can you give me a video to configure ES?

And why I didn't have inputs.conf?

[gcusello]

Hi @NeedNotToKnow,

you don't have inputs.conf because this file is usually on the forwarders that ingest data flows, not on the ES server.

About ES configuring, it isn't so immediate, and I hint to follow a training, otherwise it will very hard!

Anyway, here you can find some documentatin and tutorials:

https://lantern.splunk.com/Security/Getting_Started/Configuring_and_optimizing_Enterprise_Security

https://www.youtube.com/watch?v=YMtJjoVk4q0

https://www.youtube.com/watch?v=IA2QwdpCm74

https://www.youtube.com/watch?v=QdM6JvnYu7g

https://www.youtube.com/results?search_query=splunk+enterprise+security

Ciao.

Giuseppe

[NeedNotToKnow]

I can’t solve the problem

index = notable

is empty..

[gcusello]

Hi @NeedNotToKnow,

check if you have events in Data Models and if you activated some Correlation Search.

Notable index receive events from the CSs, if you don't enable them and they don't trigger alerts, you'll not have notables.

I cannot hint a CS to start because they depends on the data you have.

As I said, install the Security Essentials App to see which CS are possible to enable.

Ciao.

Giuseppe

[NeedNotToKnow]

Sorry I bothered you many times

Notable get its events from correlation searches ok?

But when I install SPLUNK ES there are many prebuilt CSs

So my task just go and enable them, right?

But these correlation searches run on what index?

For example, if I have two indexes firewall-1 & firewall-2

Is it by default will run these CSs on both of indexes?

Or should I manually edit it? If yes, How?

Did you get me? Sorry for bothering