Splunk Enterprise Security

Can we merge notable events from Splunk IT Service Intelligence and Splunk Enterprise Security?

paulstout
Path Finder

Is it possible to merge the notable events from Splunk IT Service Intelligence (ITSI) and Splunk Enterprise Security (ES)? Ideally, I'd like to create a single location where our analysts can review incidents. ITSI is not in production at this time, but it would be possible to install that on an ES search head if that would help. Any insight would be appreciate, thanks!

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

This is not possible at this time.

This is largely due to the added search performance that you would incur by having both apps hitting the same indexers. In addition, the notable events are stored in separate indexes for both apps and cannot be viewed in a unified view. For performance reasons and CIM- and other supporting add-on incompatibilities that can occur, it isn't recommended to install ITSI and ES on the same search head.

Do you have one ops team that would be reviewing and responding to both IT outages and security incidents? I'd be interested to hear more about the use case for a unified view at your organization.

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

This is not possible at this time.

This is largely due to the added search performance that you would incur by having both apps hitting the same indexers. In addition, the notable events are stored in separate indexes for both apps and cannot be viewed in a unified view. For performance reasons and CIM- and other supporting add-on incompatibilities that can occur, it isn't recommended to install ITSI and ES on the same search head.

Do you have one ops team that would be reviewing and responding to both IT outages and security incidents? I'd be interested to hear more about the use case for a unified view at your organization.

paulstout
Path Finder

Thank you! Yes, our platform services team is responsible for care and feeding of Splunk as well as some of the ES notable events. My question was from a desire to create a single pane of glass -- ideally filtered views for different teams -- for a better user experience, easier to manage, etc etc.

I can appreciate the difficulty in integrating these -- maybe moving the notable events to the kvstore would make this easier in future releases?

Thanks again, this answered my question.

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Thanks for the added context, Paul!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...