Splunk Enterprise Security

Can we merge notable events from Splunk IT Service Intelligence and Splunk Enterprise Security?

paulstout
Path Finder

Is it possible to merge the notable events from Splunk IT Service Intelligence (ITSI) and Splunk Enterprise Security (ES)? Ideally, I'd like to create a single location where our analysts can review incidents. ITSI is not in production at this time, but it would be possible to install that on an ES search head if that would help. Any insight would be appreciate, thanks!

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

This is not possible at this time.

This is largely due to the added search performance that you would incur by having both apps hitting the same indexers. In addition, the notable events are stored in separate indexes for both apps and cannot be viewed in a unified view. For performance reasons and CIM- and other supporting add-on incompatibilities that can occur, it isn't recommended to install ITSI and ES on the same search head.

Do you have one ops team that would be reviewing and responding to both IT outages and security incidents? I'd be interested to hear more about the use case for a unified view at your organization.

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

This is not possible at this time.

This is largely due to the added search performance that you would incur by having both apps hitting the same indexers. In addition, the notable events are stored in separate indexes for both apps and cannot be viewed in a unified view. For performance reasons and CIM- and other supporting add-on incompatibilities that can occur, it isn't recommended to install ITSI and ES on the same search head.

Do you have one ops team that would be reviewing and responding to both IT outages and security incidents? I'd be interested to hear more about the use case for a unified view at your organization.

paulstout
Path Finder

Thank you! Yes, our platform services team is responsible for care and feeding of Splunk as well as some of the ES notable events. My question was from a desire to create a single pane of glass -- ideally filtered views for different teams -- for a better user experience, easier to manage, etc etc.

I can appreciate the difficulty in integrating these -- maybe moving the notable events to the kvstore would make this easier in future releases?

Thanks again, this answered my question.

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Thanks for the added context, Paul!

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...