Splunk Enterprise Security

Enterprise security engineering tasks

vikram1583
Explorer

Hi in my company they recently migrated to Spunk(Enterprise Security) from QRador so installation part is done rule creation is done
and Vulnerability center , asset data feed,user data feed,tuning correlation searches,
work flow, run books done, so now they are moving to Engineering on demand work so they asked me to prepare engineering tasks for next few months so i don't have idea what tasks will be i never worked on ES
Can some one help me please.

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

If you've installed the product, set up correlation searches and asset and identity correlation, plus tuned the searches and confirmed that Vulnerability Center is working, I'd say that the next steps are for the SOC analysts and security teams to actually use the product, and then get engineering-on-demand tasks from those teams.

Are there integrations with tools that those teams use that aren't set up? Are there additional data sources that they might want later? Or some adaptive response or workflow actions that they might want set up so that they can more easily respond to and remediate issues? Those are some tasks that might come up later, but you'll have to work with the security teams to understand their use cases and what they cannot do with ES now that it's set up that might require extending it. You can find documentation about how to write new adaptive response actions on dev.splunk.com: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBF

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

If you've installed the product, set up correlation searches and asset and identity correlation, plus tuned the searches and confirmed that Vulnerability Center is working, I'd say that the next steps are for the SOC analysts and security teams to actually use the product, and then get engineering-on-demand tasks from those teams.

Are there integrations with tools that those teams use that aren't set up? Are there additional data sources that they might want later? Or some adaptive response or workflow actions that they might want set up so that they can more easily respond to and remediate issues? Those are some tasks that might come up later, but you'll have to work with the security teams to understand their use cases and what they cannot do with ES now that it's set up that might require extending it. You can find documentation about how to write new adaptive response actions on dev.splunk.com: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBF

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...