Where can I find a list of the standard use cases Splunk comes with?

[marktait1971]

I'm looking for a list of "out of the box" use cases that Splunk comes with - to do a gap analysis between that, and a Splunk SIEM we've taken over.

Thanks for any help,

Mark

[gcusello]

Hi @marktait1971,
you could start to see in the following urls:
https://docs.splunk.com/Documentation/ES/6.0.0/Admin/Introduction
https://docs.splunk.com/Documentation/UseCases/usecases/Security/Summary
https://docs.splunk.com/Documentation/ES/6.0.0/Usecases/Overview

then this video is very useful:
https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html

Ciao.
Giuseppe

[marktait1971]

Thank you - those are useful, but is there a simple list of use cases listed anywhere that you know of?

[gcusello]

maybe this could be useful
https://docs.splunk.com/Documentation/ESSOC/1.0.48/stories/UseCase

Ciao.
Giuseppe

[nickhills]

They are updated very frequently, and are only (to my knowledge) completely detailed in the Security Essentials App (which is updated just as frequently)

Just an addendum - they are also detailed inside ES, but unless you have access to ES, that is of less help.

[nickhills · Accepted solution]

That somewhat depends on if you are looking at Splunk Core, or specifically any of the premium apps like Splunk Enterprise Security (ES) or Splunk IT Service Intelegence (ITSI) or even Splunk UBA.

Assuming you are approaching this from a security standpoint the Splunk Security Essentials App
https://splunkbase.splunk.com/app/3435/ lists numerous ootb use cases, and the products they apply to.

[marktait1971]

Thank you - I found it via your link: https://docs.splunksecurityessentials.com/content-detail/