analyze this data in Splunk

[tuts]

Scenario: The device has been compromised, and we want to understand how the breach occurred. We have extracted data from the device from the Setup, Security, and Application logs in CSV format and uploaded it to Splunk.

Question: What is the best way to automatically analyze this data in Splunk and identify any suspicious information

[tuts]

That's sad.
Are there other tools that help me with analysis?
And what do you advise

[gcusello]

Hi @tuts ,

I performed a similar search in the past: there's no automatic analysis that you can perform, youcan search for the inbound accesses and outbound transaction, you can only search, with a security specialist to identify some possible threat or compromise.

Ciao.

Giuseppe

[tuts]

That's sad.
Are there other tools that help me with analysis?
And what do you advise

[gcusello]

Hi @tuts ,

in my opinion, only the knowledge of a security analyst can help you in the search.

You could install some app for the technologies you have but, I think that only a deep knowledge of attack methods and technics can support you.

Ciao.

Giuseppe