Splunk Enterprise Security

Questions about getting started with Splunk Enterprise Security

rchan11
Explorer

Hi,

I'm new to Splunk Enterprise Security but we do have Splunk to monitor and alert on our application logs.

Are there white papers about how to implement and scale an existing implementation?

1) What logs can you monitor with the Enterprise Security app?
2) With switches, routers, etc. sitting remotely do you recommend having a Splunk instance running on the remote location and using the Standalone Splunk instance to forward it to centralized indexers?

Thanks,
Ryan

0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

There is deployment and scaling information in the Installation Manual, see Deployment planning.

You should also definitely read the Data source planning topic.

There are also use cases and a correlation search tutorial, in addition to the dashboard information that lfedak pointed out.

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

There is deployment and scaling information in the Installation Manual, see Deployment planning.

You should also definitely read the Data source planning topic.

There are also use cases and a correlation search tutorial, in addition to the dashboard information that lfedak pointed out.

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @rchan11, For your first question:
You can learn more about the Splunk ES use cases by reading through the documentation here: http://docs.splunk.com/Documentation/ES/4.7.2/User/Domaindashboards and following relevant links.
There are also white papers and product briefs on this page: https://www.splunk.com/en_us/products/premium-solutions/splunk-enterprise-security.html
There is a virtual course available if you have a budget for that: https://www.splunk.com/view/SP-CAAAGCS

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Here is the correct link to the Enterprise Security course description: https://www.splunk.com/view/SP-CAAAGCS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...