Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise Security
- :
- Fine-tuning Enterprise Security?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello everyone!
I'm looking for assistance with fine-tuning Enterprise Security.
I've been working hard with configuring ES to start generating notable events.
We're getting lots of events! Almost 73k Access Notables, 66 Endpoint Notables, 2.4k Network Notables, 0 Identity Notables, 11 Audit Notables, and 3.8k Threat Notables.
What does a typical fine-tuning entail? Finding out what is a false-positive and modifying the correlation searches to ignore certain criteria? What else could I be missing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. In Short -
# 1 - Finding out what is a false-positive and modifying the correlation searches to ignore certain criteria which you mentioned
# 2 Under "Content Management" , review the prebuilt searches that come with ES by default. In our environment, we disabled all the default ones because those generate lot of noise. Perform a detailed review which ones you want to keep and disable the rest.
#3 Under each Correlation searche, you can chose what "Adaptive Response" to trigger - such as generate a Notable, send an email etc. Check which ones don't need a notable to be triggered.
# 4 Customize the Throttle settings under those searches which are generating lot of repetitive alerts, also adjust the schedule of correlation searches if possible to run less frequently ( depending on the use case).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. In Short -
# 1 - Finding out what is a false-positive and modifying the correlation searches to ignore certain criteria which you mentioned
# 2 Under "Content Management" , review the prebuilt searches that come with ES by default. In our environment, we disabled all the default ones because those generate lot of noise. Perform a detailed review which ones you want to keep and disable the rest.
#3 Under each Correlation searche, you can chose what "Adaptive Response" to trigger - such as generate a Notable, send an email etc. Check which ones don't need a notable to be triggered.
# 4 Customize the Throttle settings under those searches which are generating lot of repetitive alerts, also adjust the schedule of correlation searches if possible to run less frequently ( depending on the use case).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you! That was exactly what I was looking for.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
