Splunk Enterprise Security

Fine-tuning Enterprise Security?

Stefanie
Builder

Hello everyone!

I'm looking for assistance with fine-tuning Enterprise Security.

I've been working hard with configuring ES to start generating notable events. 

We're getting lots of events! Almost 73k Access Notables, 66 Endpoint Notables, 2.4k Network Notables, 0 Identity Notables, 11 Audit Notables, and 3.8k Threat Notables. 

What does a typical fine-tuning entail? Finding out what is a false-positive and modifying the correlation searches to ignore certain criteria? What else could I be missing? 

0 Karma
1 Solution

neerajs_81
Builder

Yes. In Short - 
# 1 -  Finding out what is a false-positive and modifying the correlation searches to ignore certain criteria which you mentioned

# 2 Under "Content Management" , review the prebuilt searches that come with ES by default.  In our environment, we disabled all the default ones because those generate lot of noise.  Perform a detailed review which ones you want to keep and disable the rest.

#3 Under each  Correlation searche, you can chose what "Adaptive Response" to trigger - such as generate a Notable, send an email etc.    Check which ones don't need a notable to be triggered.

# 4  Customize the Throttle settings under those searches which are generating lot of repetitive alerts, also adjust the schedule of correlation searches if possible to run less frequently ( depending on the use case).

 

 

View solution in original post

neerajs_81
Builder

Yes. In Short - 
# 1 -  Finding out what is a false-positive and modifying the correlation searches to ignore certain criteria which you mentioned

# 2 Under "Content Management" , review the prebuilt searches that come with ES by default.  In our environment, we disabled all the default ones because those generate lot of noise.  Perform a detailed review which ones you want to keep and disable the rest.

#3 Under each  Correlation searche, you can chose what "Adaptive Response" to trigger - such as generate a Notable, send an email etc.    Check which ones don't need a notable to be triggered.

# 4  Customize the Throttle settings under those searches which are generating lot of repetitive alerts, also adjust the schedule of correlation searches if possible to run less frequently ( depending on the use case).

 

 

Stefanie
Builder

Thank you! That was exactly what I was looking for.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...