Splunk Enterprise Security

How do you detect WannaCry by Splunk Enterprise Security Content Updates?

test_qweqwe
Builder

It's impossible to detect WannaCry by app ES Content Updates?
Someone have experience in this?

app: https://splunkbase.splunk.com/app/3449/

0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

If you haven't looked at the Splunk Security Essentials for Ransomware app, it has some useful reference searches.

There is also a Security Investigation online demo that might give you some pointers.

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

If you haven't looked at the Splunk Security Essentials for Ransomware app, it has some useful reference searches.

There is also a Security Investigation online demo that might give you some pointers.

lloydknight
Builder

Hello test_qweqwe

These links might help by blocking the domains that could host ransomware using Splunk ES.

Official Documentation:
http://docs.splunk.com/Documentation/ES/4.6.0/User/Configureblocklists#Add_a_ransomware_threat_feed_...

Splunk Blog:
https://www.splunk.com/blog/2017/01/24/enhancing-enterprise-security-for-ransomware-detection.html

Hope it helps!

Thanks!

Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...