What are the key details I should pay attention to when rewriting searches to correlation searches?

[test_qweqwe]

Hello all!
What should I do or what should I know, (maybe some tricks or magic) if I need to quickly rewrite my searches to correlation searches that will work with CIM Data Models? My SPL skills are limited when it comes to correlation searches & notable events (even with documentation).

Maybe, what should I pay attention when I will rewrite them? Maybe it's not as difficult as it seems to me after documentation 😄

[jgbricker · Accepted solution]

Explore using data models and tstats. Searches should be fast running. Likely want to keep to 25 or less overall. Depends on what you want ES to do for you. Correlation searches will generate saved searches that are linked and have -rule at the end. Think of ES as a framework. Learn what searches are needed for the dashboards you want to use. Unfortunately learning ES and knowing what searches you need is not easy. It’s a journey.
Check out the Splunk security essentials app which has 60+ examples. There is also one for PCI and Ransomware

https://splunkbase.splunk.com/app/3435/

Check out Splunk conf talks around ES.

I think my favorite talk was Doug Browns “The Art of Detection with Enterprise Security”.

http://conf.splunk.com/sessions/2017-sessions.html

his session - http://conf.splunk.com/sessions/2017-sessions.html#search=art%20of%20detection&