Splunk Enterprise Security

Does upgrading Security Essentials App require the ES content App to be updates to the current ver. (3.29.0) ? Thx

SamHTexas
Builder

I am about to upgrade the Security Essentials App (Installed on ES) to it's most current version 3.4.0. I read that Security Essentials depends on ES content update App. The question is do I need to update this to it's latest version as well? Thank u very much for your response in advance.

Labels (1)
Tags (1)
0 Karma

ro_mc
Path Finder

No, there is no dependency between Splunk Security Essentials (SSE) and Enterprise Security Content Updates (ESCU), but you should definitely update the ESCU frequently as it provides monthly updates to analytics, analytic stories, and associated content.

However, SSE does specify recommended add-ons within the app itself, stated as follows from the link below: "On the Security Content page, add-ons that you need to configure to make a detection work are now recommended and linked to from the detection. "

https://docs.splunk.com/Documentation/SSE/latest/ReleaseNotes/Enhancements

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...