Splunk Enterprise Security

Learning SIEM basics

hemendralodhi
Contributor

Hello,

I now have fairly good experience with Splunk and want to learn more about SIEM but not sure where to start. I am from application side and have handled various applications in the past. I want to learn SIEM basics so that I have good idea when dealing with Splunk SIEM.

Any help or pointer is greatly appreciated.

Thanks
Hemendra

0 Karma

mdessus_splunk
Splunk Employee
Splunk Employee

My advice: do not think about product, but think about your needs: what are the risk for your company, mainly the business ones ?
Then, you will be able to identify scenarios you want to detect (for the correlation), check you want to do (for compliance), and what kind of anomalies you want to identify (for the analytic part).
So SIEM is just a tool that does not answer all security needs. That said, you might have a look to ES documentation and look for .conf presentation for real use case.

hemendralodhi
Contributor

Thanks mdessus for your input. I will follow above tip.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...