Enterprise Security: How do we enable automatic updates by the ESCU?

[danielbb]

We are wondering how to enable the automatic updates by the ESCU. We have it working fine but it doesn't seem to fetch new cases...

[woodcock]

It does not update automatically but, if your Search Head can reach splunkbase.splunk.com and you have not turned off the feature, you should see the [update] strings in the app pane for this (and any other) app after a new version is released. Your users will generally let you know soon enough after this happens so don't worry about watching for it.

[danielbb]

Thank you @woodcock !

[harsmarvania57]

Hi,

Do you mean when new Analytic stories published in newer version of ESCU app, you want to pull those Analytic stories automatically ? In this you need to upgrade the ESCU app which will have new content, there are no such automatic way in ESCU app or inbuilt in splunk.

[danielbb]

Very interesting @harsmarvania57 - we were under the impression that there is a way to get the Analytic stories automatically. Thanks a lot!

[lkutch_splunk]

Thanks. I've updated the docs to reflect that.