Splunk Enterprise Security

Enterprise Security: How do we enable automatic updates by the ESCU?

danielbb
Motivator

We are wondering how to enable the automatic updates by the ESCU. We have it working fine but it doesn't seem to fetch new cases...

0 Karma

woodcock
Esteemed Legend

It does not update automatically but, if your Search Head can reach splunkbase.splunk.com and you have not turned off the feature, you should see the [update] strings in the app pane for this (and any other) app after a new version is released. Your users will generally let you know soon enough after this happens so don't worry about watching for it.

danielbb
Motivator

Thank you @woodcock !

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Do you mean when new Analytic stories published in newer version of ESCU app, you want to pull those Analytic stories automatically ? In this you need to upgrade the ESCU app which will have new content, there are no such automatic way in ESCU app or inbuilt in splunk.

danielbb
Motivator

Very interesting @harsmarvania57 - we were under the impression that there is a way to get the Analytic stories automatically. Thanks a lot!

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

Thanks. I've updated the docs to reflect that.

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...