- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- What are the key details I should pay attention to...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello all!
What should I do or what should I know, (maybe some tricks or magic) if I need to quickly rewrite my searches to correlation searches that will work with CIM Data Models? My SPL skills are limited when it comes to correlation searches & notable events (even with documentation).
Maybe, what should I pay attention when I will rewrite them? Maybe it's not as difficult as it seems to me after documentation 😄
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Explore using data models and tstats. Searches should be fast running. Likely want to keep to 25 or less overall. Depends on what you want ES to do for you. Correlation searches will generate saved searches that are linked and have -rule at the end. Think of ES as a framework. Learn what searches are needed for the dashboards you want to use. Unfortunately learning ES and knowing what searches you need is not easy. It’s a journey.
Check out the Splunk security essentials app which has 60+ examples. There is also one for PCI and Ransomware
https://splunkbase.splunk.com/app/3435/
Check out Splunk conf talks around ES.
I think my favorite talk was Doug Browns “The Art of Detection with Enterprise Security”.
http://conf.splunk.com/sessions/2017-sessions.html
his session - http://conf.splunk.com/sessions/2017-sessions.html#search=art%20of%20detection&
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Explore using data models and tstats. Searches should be fast running. Likely want to keep to 25 or less overall. Depends on what you want ES to do for you. Correlation searches will generate saved searches that are linked and have -rule at the end. Think of ES as a framework. Learn what searches are needed for the dashboards you want to use. Unfortunately learning ES and knowing what searches you need is not easy. It’s a journey.
Check out the Splunk security essentials app which has 60+ examples. There is also one for PCI and Ransomware
https://splunkbase.splunk.com/app/3435/
Check out Splunk conf talks around ES.
I think my favorite talk was Doug Browns “The Art of Detection with Enterprise Security”.
http://conf.splunk.com/sessions/2017-sessions.html
his session - http://conf.splunk.com/sessions/2017-sessions.html#search=art%20of%20detection&
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
