correlation searches

[tuts]

Peace be upon you. I am now running correlation searches and I do not have data to fully test them. I want to activate them in order to protect the company from any attack. I have MITRE ATT&CK Compliance
Security Content
But I do not know where to start and how to arrange myself
I hope for advice

[gcusello]

Hi @tuts ,

are you speaking of Enterprise Security?

Anyway, if you install the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435) you have all the available Correlation Searches and for each one there's s test data set that you can use.

Ciao.

Giuseppe