Ask for the recommended Apps should enhance the Security Posture

[AliMaher]

Hello ES Splunker,

I want to know if any applications can be installed to enhance the security posture alongside with Enterprise Security.

is ITSI App added value for the security posture?

[meetmshah]

Along with what @richgalloway suggested (Splunk Security Essentials / SSE), I would also go for Splunk ES Content Update (ESCU, https://splunkbase.splunk.com/app/3449)

The analytic stories and their searches are also available at - https://github.com/splunk/security_content

Please hit Karma, if this helps!

[richgalloway]

Yes, other apps can be installed with ES to help improve your security monitoring abilities.  A common one is Splunk Security Essentials, but there are many others.  Go to apps.splunk.com to see what is available and choose those that support the products you need to monitor.

Use caution when installing apps on your ES SH because ES uses a lot of resources.  Apps that don't contribute directly to your ES use cases should be installed on a separate SH.

ITSI is not a security product and should be installed on its own SH.

[PickleRick]

In fact, product requirements for either ES or ITSI state that they must not be installed together on the same SH(C). Or at least said so about two years ago when I last checked but I wouldn't expect it to change.