Splunk Enterprise Security: Why are all my notable events showing "0"?

[jgorman_THG]

Hello,

Under security posture, all my notable events are showing 0 and I am not sure if it is working but we just haven't had a notable event, or if it isn't working.

Can someone tell me how I can confirm that this part of ES is working?

Thanks,

JG

[smoir_splunk]

Hello @jgorman_THG,

I'd check a couple things:
* Are there notable events on incident review, but not security posture?
* If there are no notable events on incident review or on security posture, make sure that you have correlation searches enabled. Check the Content Management page (Configure > Content Management).

Let me know what you find on incident review and content management!

[jgorman_THG]

Hi!

Looks like the correlation searches were not enabled.

Am I safe to enable all of them? Do I need to make any changes?

Thanks,

JG

[smoir_splunk]

Hello JG,
Do not enable all of them, you only want to enable the ones that fit your security use cases, and the data that you have in Splunk Enterprise Security. For example, if you have endpoint logs and care about malware infections, you can enable the correlation searches that pertain to malware activity detection. You have to understand the data in your system, then make a decision about which correlation searches to enable (and thus which alerts your analysts should see).
See more here: http://docs.splunk.com/Documentation/ES/4.5.0/User/ConfigureCorrelationSearches (this advice mostly applies even if you're not running 4.5.0)

Let me know if you have any questions!
Thanks,
Sarah

[jgorman_THG]

Hi,

Thanks a lot for your help.

So I've activated them and under activities I can see that the jobs are running, but they're all coming up with '0' results.

Under the security domains, there is data coming in.

Is it possible I just haven't had any notable events in the time since I activated them?

Thanks,

JG

[smoir_splunk]

Hello JG,

That is possible. One thing you could also check is the Content Profile dashboard to see which data models have data in them, and then which knowledge objects you can use with those data models.

• If you enabled correlation searches for data models without accelerated data, you still won't see notable events.
• If the correlation searches (identified on the content profile page by - - Rule) are enabled for data models that have data, then it's likely that you don't have any notable events since you enabled the correlation searches.

Let me know if that helps!
Thanks,
Sarah