Datasets and ideas for Splunk Enterprise Security

[badr_boukari]

Hello the team,

I am currently preparing a Splunk Lab for my office, and I need the datasets specially for Splunk Enterprise Security.

I am trying to deploy a Splunk Entreprise Security (ES) environment in our Lab but we have a lack of data (Events, Notable Events, …)

Can u propose to me some datasets to aliment ES ? Otherwise, what u can propose as suggestions to deploy Splunk Enterprise Security in our Splunk Lab.

Thanks in advance for your help.

Have a nice day.

[inventsekar]

ahh, the splunk ES datasets are sooo complex. 

but, i would suggest you to register for a Splunk ES Sandbox

https://www.splunk.com/page/sign_up/en_us/getsplunk/es_sandbox

and then, try to replicate/create,  as many as possible to you, on your lab. all the very best for your ES Lab Setup(i wish i had one for me too)

Best Regards,

Sekar

PS - your karma points will be my 2 cents!

[badr_boukari]

Hello, 

Thank you so much for your response. 

The link https://www.splunk.com/page/sign_up/en_us/getsplunk/es_sandbox doesn't work for me! 

i already have a splunk account, when i tryed to log-on, i was redirected to splunk.com 

Can you please connect to your account and then, send me the link for ES_Sandbox? 

Thank you in advance. 

Best regards.

Badr, 

[richgalloway]

Enterprise Security uses data already indexed by Splunk  That is, the stuff from your firewalls, AD, servers, etc..  There's nothing special about ES data.

ES will create notable events when you enable the appropriate correlation searches and those searches find something of note in your data.

I recommend you clone some of your production data to your lab so you have a "realistic" data set.

[badr_boukari]

Hello richgalloway, 

Thank you so much for your response. 

I try to generate ficitf data from Eventgen, and realize ES scenarios. It's difficult to clone some of production data to the lab.

I have now an other problem, ES doesn't create notable events when i enable the appropriate correlation searches.  Where it can come  from? any ideas? 

Thanks in advance.

Badr, 

PS:  i give you the upvote!