Splunk Enterprise Security

How to set up a SOC with Splunk ?

mbdiameth
New Member

I have no experience and I need to set up a SOC/NOC with Splunk. Thank you for andurstanding me and helping me.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Did you take a look at

https://www.splunk.com/pdfs/technical-briefs/building-a-soc-with-splunk-tech-brief.pdf

Or

https://www.slideshare.net/Splunk/sl-2015-houstonbuildingsocherrald

There are lots of resources online but you can't summarise a several months or years job in one answer I'm afraid.
My only advice if you don't have the experience would be to hire someone with that experience first and then start from that.

Thanks,
J

0 Karma

mbdiameth
New Member

Thank you for this precious help to enlighten me

0 Karma

tomasmoser
Contributor

Hi,

There is a book that describes generic principles about how to deploy a central big data SIEM (in reality Splunk) that is hard of SOC.
Crafting the Infosec - http://shop.oreilly.com/product/0636920032991.do. It's written by Cisco CSIRT team members.

Tomas

0 Karma

mbdiameth
New Member

Thank you for this precious help to enlighten me

0 Karma

mdessus_splunk
Splunk Employee
Splunk Employee

A SOC and NOC are a combination of tools, processes, people.
Splunk can be the tool for collecting data (logs, metrics, networks streams...) in order to monitor availability/performance and security (correlation, analytics, fraud...). It will be also a great tool for investigation in both cases.

mbdiameth
New Member

Thank you for this precious help to enlighten me

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...