Splunk Enterprise Security

New Security Domain

Explorer

I want to add a new Security Domain called "Email" in Enterprise Security (ES) App and later map it to notables. Right now "Threat", "Network", "Identity" are among a few that are available. Is there a way to achieve this ?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi,

yes, you can modify the lookup that is responsible for the available Security Domains (which is also the name of the lookup). Take a look here for an overview of the internal ES lookups: https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Manageinternallookups

Skalli

View solution in original post

SplunkTrust
SplunkTrust

Hi,

yes, you can modify the lookup that is responsible for the available Security Domains (which is also the name of the lookup). Take a look here for an overview of the internal ES lookups: https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Manageinternallookups

Skalli

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!