Security

What type of security threats is Splunk most effective at responding to?

dave_smith
New Member

Hi guys,

Regarding Splunk's SIEM system, what type of threats is it most effective at responding to?

Thank you!

0 Karma

woodcock
Esteemed Legend

That's the beauty; you get to decide! There is a very substantial pool of existing correlation searches that you can enable and if your desired search doesn't exist, you can create it. I guess the bast answer is "correlated attacks" and by that I mean that various things happen in multiple systems close to eachother in time. That is really the power of Splunk/ES.

0 Karma

mrgibbon
Contributor

In essence, It can be taught via SPL and alerting to detect and respond to any threat you wish.
There isnt really any "most effective" as such, as it can do anything you want, and do it consistently well.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...