The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.
In this use case, we'll explore how to use Splunk Enterprise Security to alert when a service in the prohibited process list is detected.
This use case depends on process monitoring data contained within the Processes dataset of the Endpoint datamodel as defined by the Common Information Model. Although this use cases focuses on data from running processes of Windows and Unix or Linux, any data that is properly normalized for the Processes dataset works well. It’s a best practice to use the CIM to normalize data at search time, but before you put in effort to create new knowledge objects, check Splunkbase to see if such a CIM-compatible app or add-on already exists.
Best practice: In searches, replace the asterisk in
index= with the name of the index that contains the data. By default, Splunk stores data in the 'main' index. Therefore,
index=main. Use the
OR operator to specify one or multiple indexes to search. For example,
index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Best practice: Use the Splunk Add-on for Microsoft Windows to accelerate time to value
time to value with Windows data. For details, see Is it a best practice to use the Splunk Add-on for Microsoft Windows? on Splunk Answers.
[perfmon://ProcessorInformation]inputs in the add-on to collect Windows process and processor data. For details, see Monitor Windows performance in the Splunk Getting Data In Manual.
earliest=-1day index=* sourcetype=*mon* tag=process tag=report | head 10
Best practice: Use the Splunk Add-on for Unix and Linux to accelerate time to value with Unix and Linux data.
[script://./bin/ps.sh]input in the add-on to collect the Linux process data. See Enable data and scripted inputs for the Splunk Add-on for Unix and Linux in Splunk docs for the procedure.
earliest=-1day index=* ( sourcetype=ps OR sourcetype=top ) tag=process tag=report | head 10
Best practice: Since Splunk normalizes values from multiple source types regardless of source or format, it’s a best practice to make sure your data is CIM-compliant. For more information about CIM and the Splunk Common Information Model (CIM) add-on see the Splunk Common Information Model Add-on Manual. Run the following search to verify you are searching for normalized Processes data and ready for this use case:
earliest=-1day index=* tag=process tag=report | head 10
For more details about the Common Information Model, watch the following video.
Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If no results appear, there may not be any notable notable events. However, you may need to enable correlation searches.
If no results appear, you may need to deploy the add-ons to the search heads to use the knowledge objects necessary for simple searching.