Splunk Security Essentials - data available

Security

Hi all,

I have the Splunk Security Essentials app installed and configured.

I am trying to understand how the app determine if a rule has data or not, because there are rules that do have logs but their status is "needs data".

There is the commend sseanalytics, but I am not sure how it works.

Thanks !

Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...