Security

Example of web uploads by a user to non-corporate sites use case?

adukes_splunk
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk to check for high volume web uploads by a user to non-corporate domains?

0 Karma
1 Solution

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.

In this use case, we'll explore how to use Splunk Enterprise Security to uncover high volume web uploads by a user to non-corporate domains.

Finding Large Web Uploads

Load data

This use case depends on the Web data as defined by the Common Information Model (CIM). Although the focus is on web data from Microsoft IIS, Apache Web Server, and NGINX, any data properly normalized for the Web datamodel works well. It’s a best practice to use the CIM to normalize data at search time, but before you put in effort to create new knowledge objects, check Splunkbase to see if such a CIM-compatible app or add-on already exists.

Deploy the appropriate add-ons for Splunk Add-on for Microsoft IIS, Splunk Add-on for Apache Web Server, or Splunk Add-on for NGINX and enable the necessary inputs listed in the add-ons respective documentation. Pay special attention to the distributed deployment instructions to properly use the accompanying knowledge objects such as tags, fields, that are required for this use case.

Get insights

This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:

  1. Navigate to the Splunk Enterprise Security web user interface.
  2. Select Incident Review from the top navigation bar.
  3. Select the text box under Correlation Search, begin typing Web Uploads to Non-corporate Sites by Users, then select the appropriate result from the result set.
  4. Select Submit to display notable events.

Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If no results appear, there may not be any notable notable events or you may need to enable correlation searches.

If no results appear, you may need to deploy the add-ons to the search heads to use the knowledge objects necessary for simple searching.

View solution in original post

0 Karma

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.

In this use case, we'll explore how to use Splunk Enterprise Security to uncover high volume web uploads by a user to non-corporate domains.

Finding Large Web Uploads

Load data

This use case depends on the Web data as defined by the Common Information Model (CIM). Although the focus is on web data from Microsoft IIS, Apache Web Server, and NGINX, any data properly normalized for the Web datamodel works well. It’s a best practice to use the CIM to normalize data at search time, but before you put in effort to create new knowledge objects, check Splunkbase to see if such a CIM-compatible app or add-on already exists.

Deploy the appropriate add-ons for Splunk Add-on for Microsoft IIS, Splunk Add-on for Apache Web Server, or Splunk Add-on for NGINX and enable the necessary inputs listed in the add-ons respective documentation. Pay special attention to the distributed deployment instructions to properly use the accompanying knowledge objects such as tags, fields, that are required for this use case.

Get insights

This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:

  1. Navigate to the Splunk Enterprise Security web user interface.
  2. Select Incident Review from the top navigation bar.
  3. Select the text box under Correlation Search, begin typing Web Uploads to Non-corporate Sites by Users, then select the appropriate result from the result set.
  4. Select Submit to display notable events.

Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If no results appear, there may not be any notable notable events or you may need to enable correlation searches.

If no results appear, you may need to deploy the add-ons to the search heads to use the knowledge objects necessary for simple searching.

0 Karma

adukes_splunk
Splunk Employee
Splunk Employee

Added related video.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...