Splunk Enterprise

SIEM implementation with Splunk Enterprise

Monica7
New Member

Could you please tell me how to implement SIEM with Splunk Enterprise.

I came to know that there are two ways to Implement SIEM with Splunk
one method is with Splunk Enterprise and another one method is Splunk Enterprise Security. As i will be using free trial version for implementation for now , i cant use Splunk Enterprise security since it is separate volume-based license for the app on top of your regular Splunk license.So could you please share me the document which deals with SIEM Implementation using Splunk Enterprise.

Tags (1)
0 Karma

horsefez
Motivator

Hi,
IMHO:

SIEM isn't a product you can simply implement.
SIEM is more of a status you or your company will reach when a lot of work is done beforehand.
A SIEM is made out of a lot of different use-cases/departments like Network Access Control (NAC), Network Operation Center (NOC), Security Operation Center (SOC) or CERT to name a few.
All those use-cases/departments can use and utilize Splunk of course. But getting to that point are years and years of work.

You can ofc try to only use Splunk Enterprise for all the use-cases I named above. But ES gives you very cool dashboards, a workflow tool and a lot of logic and correalation searches for data insights
You should also read about making your data C.I.M. compliant.

0 Karma

Monica7
New Member

any update on this?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...