Splunk Search

Endpoint protection options that are Splunk friendly?

daniel333
Builder

All,

We're reselecting our endpoint protection for Windows Servers and Workstation. I'd like to start with solutions that speak splunk or have good Splunk apps. That is to say, good logs, CIM, tags, great apps that can go into Splunk relatively easy.

Obviously Splunk isn't the only measure of success here, but it's one element we're looking at. Any recommendations?

0 Karma

sumanssah
Communicator

I would recommend using "Windows Event Logs Analysis" app, this gives a good view of windows infrastructure

https://splunkbase.splunk.com/app/3067/

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...