- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- biuld a siem without Enterprise security app
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
biuld a siem without Enterprise security app
Hi i'm going to build a minimal siem in our office and because of price can't get es app what I would like to know is what if i use security essential app with some third party like wazuh and make some correlation somehow,
could i detect threat and risks?
since i can't get answer any where else ,it would be great to help me 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Agree with @radam2000, the Infosec App for Splunk is a good entry way into SIEMing without the money of ES.
I'm on the same journey you are, and it isn't the easiest. I would use the following resources to get started:
- Infosec App for Splunk
- Splunk Security Essentials
- Data visualization apps for your logs (Windows Inf App, Unix App, FW app, etc.)
You mention using third party applications. You can definitely do that, just don't set up 20 tools that you need to look out for. It's fine not having the famous 'single pane of glass', but don't have too many tools going at once!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
tnx you both for reply this is defiantly enlightening for me at this point
have you been heard about 'wazuh'? it mention itself as "Comprehensive SIEM "!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OR since my main goal is to make siem to analyze my pentest impacts or analyze attack simulations, is there other ways or even with similar applications?
tnx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
why don't you try the free InfoSec App... its also a good starting point and provides some pretty good information...
https://splunkbase.splunk.com/app/4240/
Rich
Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...
Monitoring Amazon Elastic Kubernetes Service (EKS)
Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation
