Splunk Enterprise Security

Enterprise Security: How do we enable automatic updates by the ESCU?

danielbb
Motivator

We are wondering how to enable the automatic updates by the ESCU. We have it working fine but it doesn't seem to fetch new cases...

0 Karma

woodcock
Esteemed Legend

It does not update automatically but, if your Search Head can reach splunkbase.splunk.com and you have not turned off the feature, you should see the [update] strings in the app pane for this (and any other) app after a new version is released. Your users will generally let you know soon enough after this happens so don't worry about watching for it.

danielbb
Motivator

Thank you @woodcock !

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Do you mean when new Analytic stories published in newer version of ESCU app, you want to pull those Analytic stories automatically ? In this you need to upgrade the ESCU app which will have new content, there are no such automatic way in ESCU app or inbuilt in splunk.

danielbb
Motivator

Very interesting @harsmarvania57 - we were under the impression that there is a way to get the Analytic stories automatically. Thanks a lot!

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

Thanks. I've updated the docs to reflect that.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.