Splunk Enterprise Security

How to make sense of data

michael_lee
Path Finder

So we have various types of logs that Splunk collects. E.g. Windows events, web server logs, syslogs, cisco switches and the likes. How do you make sense of such a huge amount of data that comes from different devices to find what you want, with context? Do you use Enterprise Security ? Or do you craft your own search algorithms? thanks

0 Karma
1 Solution

mdessus_splunk
Splunk Employee
Splunk Employee

Hi Michael,

It depends what you're looking for and your environment: you could just start with a few basic rules and dashboards (security or not) if you do not have much security background or are too busy. You might add ES later to have some more in depth view of your security, or add it at the beginning if you have enough people with security skills.
Keep in mind you should go step after steps, and that even with ES, you will need to adapt it to your company and threats.

View solution in original post

fdi01
Motivator

mdessus_splunk
Splunk Employee
Splunk Employee

Hi Michael,

It depends what you're looking for and your environment: you could just start with a few basic rules and dashboards (security or not) if you do not have much security background or are too busy. You might add ES later to have some more in depth view of your security, or add it at the beginning if you have enough people with security skills.
Keep in mind you should go step after steps, and that even with ES, you will need to adapt it to your company and threats.

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...