Splunk Enterprise Security

Splunk Enterprise Security: How to view all the use cases?

danielbb
Motivator

I go to Configure > Content > Use Case Library.
It shows this nice page but I can't view all the use cases.
Meaning, setting all the filters to All and I still can't see the full listing of the use cases.

alt text

What am I missing? It only shows 3 Analytic Stories.

0 Karma
1 Solution

lkutch_splunk
Splunk Employee
Splunk Employee

Hi,
Do you have ES Content Update installed?
"The ESCU analytic story content is available directly in Splunk ES through the use case library. If you do not have ESCU installed, you will see some analytic stories by default as well as a message prompting you to download and install the ESCU add-on for access to common security analytic stories."

https://docs.splunk.com/Documentation/ES/latest/Admin/Usecasecontentlibrary
https://splunkbase.splunk.com/app/3449/

View solution in original post

woodcock
Esteemed Legend

You might also download Splunk Security Essentials app, which also has use case summaries and hooks into ES.

lkutch_splunk
Splunk Employee
Splunk Employee

Hi,
Do you have ES Content Update installed?
"The ESCU analytic story content is available directly in Splunk ES through the use case library. If you do not have ESCU installed, you will see some analytic stories by default as well as a message prompting you to download and install the ESCU add-on for access to common security analytic stories."

https://docs.splunk.com/Documentation/ES/latest/Admin/Usecasecontentlibrary
https://splunkbase.splunk.com/app/3449/

danielbb
Motivator

The ES Content Updates app is installed here. Much appreciated @lkutch_splunk.

0 Karma

danielbb
Motivator

Got it. I see the three analytic stories but not the message prompting me to download the add-on.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...