Splunk Security Essentials onboard data/use case creation

[vinothn]

Hi Team,

We are trying to get data on boarded to splunk security essentials.

We do not have a clear visibility to the functioning of the app, I have now onboarded DNS data onto my Splunk Indexer using the Splunk Stream app, Its in the index=netdns as per splunk docs specification.

Now how do I turn on all the use cases related to DNS in splunk security essentials.

Followed the onboarding guide which provided in the app.(https://docs.splunksecurityessentials.com/data-onboarding-guides/stream-dns/)

[niroy_splunk]

There's a walkthrough here for how you can track content and data in your Splunk environment and how to operationalize it using different features in the Analytics Advisor section: https://docs.splunksecurityessentials.com/user/productionalize/operationalize_mitre_attack/

[johnsasikumar]

Hi All,

I too have the same issue, The documents are not clear enough as how we have to activate the use cases in the splunk security essentials app. Please could someone shed some light on this.

Thanks

John