Splunk Enterprise Security

Splunk Security Essentials and ES Integration

Albert_Cyber
Explorer

Hello everyone,

I am trying to enable some basic detections that found from the Splunk Security Essentials app. We do have ES however; we are still in the process to getting all of our data CIM complaint.

Do alerts from the Splunk Security Essentials app need to be map to to ES using the "add mapping " option? or do these basic alerts have an equivalent in the ES content management use cases tab?

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use cases do not need to be mapped from SSE to ES.  If there is an equivalent search in ES, then use that (after modifying it as necessary for your environment); otherwise, copy the SSE search into a new Correlation Search and modify it as necessary.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use cases do not need to be mapped from SSE to ES.  If there is an equivalent search in ES, then use that (after modifying it as necessary for your environment); otherwise, copy the SSE search into a new Correlation Search and modify it as necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Albert_Cyber
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...