Splunk Enterprise Security

Custom Alerts in SPLUNK Enterprise

willadams
Contributor

We have recently installed Enterprise Security and have enabled a few use cases. This was done with the guidance of SPLUNK Professional Services and for the most part the use cases, when they trigger, work (albeit with some tweaking). I am still very new to the world of data models and am still learning. What I would like to know is if I add in my own searches that don't use data models is this bad practise? For example most of the searches in ES are normal "|from datamodel "blah"". I want to put my searches based on a search, for arguments sake, the search is

"index=main sourcetype="sysmon" eventcode=4625 | where count > 50

The frequency of this search would be say every 20 minutes. If the count is >50 then the alert would trigger. I would then create this search under the "custom" app we have in the ES correlated searches to run.

0 Karma

jawaharas
Motivator

You can create your correlation rule without using datamodel.

Although, it's recommended to use accelerated datamodel for the alerts that scheduled to run at frequent interval for better performance.

References:
Configure data models for Splunk Enterprise Security
Data models used by ES

0 Karma

jawaharas
Motivator

@willadams
If my answer helped you, please accept and/or upvote it!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...