Search for Alert Monitoring.

[smith_]

hello,

Could anyone assist me in creating a correlation search to detect triggered alerts across all searches. This will enable us to monitor counts and automatically notify us if any situation escalates beyond control.

Thanks

[gcusello]

Hi @smith_,

this is the training:

https://www.splunk.com/en_us/training/course-catalog.html?filters=filterGroup4SplunkEnterpriseSecuri...

Ciao.

Giuseppe

[smith_]

@gcusello ,

Its look like a paid course by any chance it there any link of free course ?

[gcusello]

Hi @smith_,

yes except the first, they are all paid courses.

Ciao.

Giuseppe

[gcusello]

Hi @smith_ ,

No, you have only to define the asset (or the identity) in the correlation search.

In other words, in the results of your CS you must have an asset (or the identity) and define this field for the risk score.

Ciao.

Giuseppe