- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to turn on use cases using Splunk Security Essentials?
I have identified the log sources and corresponding use cases and book marked.
e.g. Basic Brute Force Detection for this use case data is available. In my environment we have ES as well. now what to do next??? ... how I can turn on the use cases or how notable event will work for the use cases?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I just clone it, and during that process change the name (we have a custom prefix that we use), change the app to SplunkEnterpriseSecurity. That way all of my live content is in ES where it should be and when I fix it so that it actually works in my environment (they all require fixing), I have not modified the original.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @woodcock, i am using Splunk SE to learn splunk security. But I am a bit confused on how to use it. Should I make a dashboard and copy the SPL to that dashboard? How does Splunk SE work? can you please help me. Thank you in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, do not edit the dashboards directly; clone what you need and edit the clone. Otherwise when you upgrade the app,you will not be able to see what changed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ES is a platform: you can think of it as a toolbox. It is not an appliance. It is what you make it to be.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Once you see a use case you like in Security Essentials, go to ES and look in the correlation searches for one of the same or similar name. Verify the search does the same thing as the one in SE and, if so, activate the correlation search.
If there is not a matching correlation search, you can create a new one using the SPL given in SE.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any way... we can turn on use cases from SSE and create notable for the same.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If it was a matter of simply "turning on" the use case in SSE then that is what I would have told you to do.
The Splunk Security Essentials app falls into the same category as Splunk Dashboard Examples and other apps that show how to accomplish a task, but doesn't actually do that task. It's up to you to implement the use case following the example shown in the app.
If this reply helps you, Karma would be appreciated.
