Splunk Enterprise Security

Splunk Enterprise Security: What is the distinction between savedsearch and correlation search?

jgbricker
Contributor

Trying to figure out why the Splunk Enterprise Security App has a savedsearch and a correlation search for brute force seems redundant but probably missing a key distinction. Can someone give me some guidance?

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

savedsearch is the search knowledge object for the notable. the correlationsearch.conf stanza goes with that and ES needs it for all the notable like settings. hooks to active responses, title, links for drill down etc.

View solution in original post

starcher
SplunkTrust
SplunkTrust

savedsearch is the search knowledge object for the notable. the correlationsearch.conf stanza goes with that and ES needs it for all the notable like settings. hooks to active responses, title, links for drill down etc.

jgbricker
Contributor

Okay so to clarify further, I would need both if I were adding my own detections into the ES framework? I didn't see that in the documentation.

0 Karma

starcher
SplunkTrust
SplunkTrust

Yes and the GUI based create process handles all that for you.
http://docs.splunk.com/Documentation/ES/4.6.0/Tutorials/CorrelationSearch

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Yes, you would need stanzas in both if you were to add your own correlation searches. However, I'd recommend that you use the content management page to create the searches so that the proper attributes are saved in the proper locations. Starting in 4.6.0, only savedsearches.conf references are needed.

0 Karma

jgbricker
Contributor

Okay, it does appear that when i add a correlation search via the UI (Content Management > Create Content) a savedsearch is created automatically. Doesn't this mean Splunk has to search for the same thing twice to do all the things it needs to do for ES. Perhaps I'm still confused here.

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

No, the search isn't performed twice, it's just a detail about how the search is stored.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...