Splunk Enterprise Security

Palo Alto and Checkpoint Event based detections

hl
Engager

Hello, 

   I see there are lots of Cisco event based detections and not many palo alto or checkpoint (fw, ids/ips, threats) events. 

 

Is everyone just creating their own event based detections for these two vendors? I do have all the TA apps installed and connectors for both vendors.  Just not seeing any event based detections that have already been setup. 

Labels (1)
Tags (2)
0 Karma

livehybrid
Ultra Champion

Hi @hl 

Have you already explored https://research.splunk.com/detections/ and/or Enterprise Security Content Updater?

I havent worked with PA events for a while now, when I did I had to create my own custom detections however I think there are more and more being added to ESCU. 

If you do end up with additional detections for PaloAlto then its worth contributing these to https://github.com/splunk/security_content so that others can benefit from them, and this also demonstrates that the wider community needs detections from PA and thus helps grow the requirement for PA detections to be built by Splunk teams.

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

hl
Engager

Thanks for the info, yes I have gone through ESCU and the Detections on the Splunk page. 

 

Looks like I'm going to have to create my own detections I guess, if I have something solid I will contribute for sure.  

 

Thanks again for replying. 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...