Palo Alto and Checkpoint Event based detections

[hl]

Hello, 

   I see there are lots of Cisco event based detections and not many palo alto or checkpoint (fw, ids/ips, threats) events. 

Is everyone just creating their own event based detections for these two vendors? I do have all the TA apps installed and connectors for both vendors.  Just not seeing any event based detections that have already been setup. 

[livehybrid]

Hi @hl 

Have you already explored https://research.splunk.com/detections/ and/or Enterprise Security Content Updater?

I havent worked with PA events for a while now, when I did I had to create my own custom detections however I think there are more and more being added to ESCU. 

If you do end up with additional detections for PaloAlto then its worth contributing these to https://github.com/splunk/security_content so that others can benefit from them, and this also demonstrates that the wider community needs detections from PA and thus helps grow the requirement for PA detections to be built by Splunk teams.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[hl · Accepted solution]

Thanks for the info, yes I have gone through ESCU and the Detections on the Splunk page. 

Looks like I'm going to have to create my own detections I guess, if I have something solid I will contribute for sure.  

Thanks again for replying.