Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Splunk Enterprise Security: What is the distinctio...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Trying to figure out why the Splunk Enterprise Security App has a savedsearch and a correlation search for brute force seems redundant but probably missing a key distinction. Can someone give me some guidance?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
savedsearch is the search knowledge object for the notable. the correlationsearch.conf stanza goes with that and ES needs it for all the notable like settings. hooks to active responses, title, links for drill down etc.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
savedsearch is the search knowledge object for the notable. the correlationsearch.conf stanza goes with that and ES needs it for all the notable like settings. hooks to active responses, title, links for drill down etc.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay so to clarify further, I would need both if I were adding my own detections into the ES framework? I didn't see that in the documentation.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes and the GUI based create process handles all that for you.
http://docs.splunk.com/Documentation/ES/4.6.0/Tutorials/CorrelationSearch
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you would need stanzas in both if you were to add your own correlation searches. However, I'd recommend that you use the content management page to create the searches so that the proper attributes are saved in the proper locations. Starting in 4.6.0, only savedsearches.conf references are needed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay, it does appear that when i add a correlation search via the UI (Content Management > Create Content) a savedsearch is created automatically. Doesn't this mean Splunk has to search for the same thing twice to do all the things it needs to do for ES. Perhaps I'm still confused here.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, the search isn't performed twice, it's just a detail about how the search is stored.
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
Data Persistence in the OpenTelemetry Collector
Thanks for the Memories! Splunk University, .conf25, and our Community
