Alarms

[dani9]

Hi questions:

1) Splunk enterprise security already has some rules from default inside? When you buy it I mean

2) where can I create rules in it? do they have to be created from splunk enterprise and exported into there or Can I create them inside that (Where)

3) do you know any free course about it to advice?

4) Risk analysis panel in it is used more for?

5) Splunk enterprise security needs one license apart other than that splunk enterprise?

6) How much does a license of that cost?

7) where can be created alarms in it? 

[richgalloway]

1) Yes.  There are many built-in correlation searches ("rules").

2) From the Enterprise Security app, go to Configure->Content Management, click the green button, and select "New Correlation Search".

3) There are no free courses for Enterprise Security.

4) The Risk Analysis panel is used for analyzing risk.  For most correlation searches, a successful search will assign a risk score to the assets and/or identities found.  The RA dashboard is used to study the assets and identities which have risk scores.

5) Yes.

6) Contact for your Splunk Account or Sales team for ES license cost.  The cost is directly related to the volume of data your Splunk environment ingests.

7) Splunk calls alarms "alerts".  In any search panel, create a search for the event(s) for which you want an alert.  When you have a working search that produces the desired results, click the Save As link and select Alert.