Greetings!!!
I am new user of splunk , and I would like to ask about splunk enterprise security, if there's any way to adjust splunk Enterprise security ?
Splunk Enterprise security showing me total count of attacks in intrusion center , i would like to ask if there is a way to customize the existing Splunk Enterprise security ?if yes it requires administrator or a user can also do it?
is there any documents or video link where i can read and know exactly what is summariesonly? and how to use it?
Kindly ,I need your help!
Thank you in advance!!
The documentation is excellent so start and end there. The summariesonly=t/f
has to do with whether your CIM datamodels
are accelerated
or not. In ES, if you are using content that accesses a CIM datamodel
, then that datamodel should first be accelerated
. As far as adjusting content, a single person or very small team should be designated content owners who do this. Anybody can create content, but only these people should be scheduling it. In general, when modifying ES correlation searches, you should always clone
the original and come up with your own naming convention standard so that it is obvious what is live
and officially supported and what is not. Everything in Splunk and ES is a search and you can easily look at the search (even the ones that drive the threat intel
stuff) and create custom content as you see fit. There are also consultants that are very good at this (we provide such services) because it can be somewhat complicated.
Docs are at https://docs.splunk.com/Documentation/ES
tstats
to only look at data in completed data model accelerations.