How to investigate and contain ransomware with Spl...

Pablo00 · ‎03-13-2022

Hi
Does anyone have examples of how to use Splunk enterprise to investigate and contain ransomware?

I would like to detect it quickly - any recommendations?

Can you share any logs from real ransomware? or screenshots? I have alerts on some ransomware popular ports like 445 etc. I am just wondering what is like red frag, traffic pick etc? Many thanks

richgalloway · ‎03-13-2022

The Splunk Security Essentials app has many use cases for detecting behaviors indicative of ransomware.

---
If this reply helps you, Karma would be appreciated.

How to investigate and contain ransomware with Splunk enterprise?

administration

other

Thanks for the Memories! Splunk University, .conf24, and Community Connections

.conf24 | Day 0

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...