Create Splunk Use Cases and Dashboard

[iremdoesthings]

My teacher gave me this task:

"You need to apply at least 3 different use cases that we will change according to your scenario. Show various use cases on the Dashboards you create. You can refer to sample use cases on the Internet or in the Security Essentials application on Splunk." but I don't know how to do this task. He gives us an empty Splunk Server and this task.

How can I create a use-case scenario?

Thank you for your time...

[gcusello]

Hi @iremdoesthings ,

I suppose that you already know Splunk and SPL, if not, let me know that I can hint some free training to start.

Anyway, as you teacher and @PickleRick hinted, the Splunk Security Essentials App. is a good starting point to find the searches for your use cases, but anyway, the real staring point is the data that you have available on your Indexer: which one do you have available?

You could analyze your data with a simple search (index=* | stats count BY sourcetype) so you can know which data source you have available and you can use.

Otherwise, in the Splunk Security Essentials App, there's a very interesting feature, that analyzes you data and says to you which searches you can implement on your data, you can find it in the app at [Data > Data Invenatry].

Ciao.

Giuseppe

[PickleRick]

A use case in this context is typically a search returning results corresponding to some security scenario. Like finding excessive failed logins or sequence of logins from a geographically distant places in a short period of time.

You need to check what data you have available, what you want to find and think how to find it. Free Security Essentials app is indeed a good source for possible use cases.