What type of security threats is Splunk most effective at responding to?

New Member

Hi guys,

Regarding Splunk's SIEM system, what type of threats is it most effective at responding to?

Thank you!

0 Karma

Esteemed Legend

That's the beauty; you get to decide! There is a very substantial pool of existing correlation searches that you can enable and if your desired search doesn't exist, you can create it. I guess the bast answer is "correlated attacks" and by that I mean that various things happen in multiple systems close to eachother in time. That is really the power of Splunk/ES.

0 Karma


In essence, It can be taught via SPL and alerting to detect and respond to any threat you wish.
There isnt really any "most effective" as such, as it can do anything you want, and do it consistently well.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...