Splunk Enterprise Security

Enterprise security engineering tasks

vikram1583
Explorer

Hi in my company they recently migrated to Spunk(Enterprise Security) from QRador so installation part is done rule creation is done
and Vulnerability center , asset data feed,user data feed,tuning correlation searches,
work flow, run books done, so now they are moving to Engineering on demand work so they asked me to prepare engineering tasks for next few months so i don't have idea what tasks will be i never worked on ES
Can some one help me please.

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

If you've installed the product, set up correlation searches and asset and identity correlation, plus tuned the searches and confirmed that Vulnerability Center is working, I'd say that the next steps are for the SOC analysts and security teams to actually use the product, and then get engineering-on-demand tasks from those teams.

Are there integrations with tools that those teams use that aren't set up? Are there additional data sources that they might want later? Or some adaptive response or workflow actions that they might want set up so that they can more easily respond to and remediate issues? Those are some tasks that might come up later, but you'll have to work with the security teams to understand their use cases and what they cannot do with ES now that it's set up that might require extending it. You can find documentation about how to write new adaptive response actions on dev.splunk.com: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBF

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

If you've installed the product, set up correlation searches and asset and identity correlation, plus tuned the searches and confirmed that Vulnerability Center is working, I'd say that the next steps are for the SOC analysts and security teams to actually use the product, and then get engineering-on-demand tasks from those teams.

Are there integrations with tools that those teams use that aren't set up? Are there additional data sources that they might want later? Or some adaptive response or workflow actions that they might want set up so that they can more easily respond to and remediate issues? Those are some tasks that might come up later, but you'll have to work with the security teams to understand their use cases and what they cannot do with ES now that it's set up that might require extending it. You can find documentation about how to write new adaptive response actions on dev.splunk.com: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBF

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...