Security

Splunk Security Essentials onboard data/use case creation

vinothn
Path Finder

Hi Team,

We are trying to get data on boarded to splunk security essentials.

We do not have a clear visibility to the functioning of the app, I have now onboarded DNS data onto my Splunk Indexer using the Splunk Stream app, Its in the index=netdns as per splunk docs specification.

Now how do I turn on all the use cases related to DNS in splunk security essentials.

 

Followed the onboarding guide which provided in the app.(https://docs.splunksecurityessentials.com/data-onboarding-guides/stream-dns/)

 

 

niroy_splunk
Splunk Employee
Splunk Employee

There's a walkthrough here for how you can track content and data in your Splunk environment and how to operationalize it using different features in the Analytics Advisor section: https://docs.splunksecurityessentials.com/user/productionalize/operationalize_mitre_attack/

0 Karma

johnsasikumar
Path Finder

Hi All,

I too have the same issue, The documents are not clear enough as how we have to activate the use cases in the splunk security essentials app. Please could someone shed some light on this.

 

Thanks

John

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...