Splunk Search

Endpoint protection options that are Splunk friendly?

daniel333
Builder

All,

We're reselecting our endpoint protection for Windows Servers and Workstation. I'd like to start with solutions that speak splunk or have good Splunk apps. That is to say, good logs, CIM, tags, great apps that can go into Splunk relatively easy.

Obviously Splunk isn't the only measure of success here, but it's one element we're looking at. Any recommendations?

0 Karma

sumanssah
Communicator

I would recommend using "Windows Event Logs Analysis" app, this gives a good view of windows infrastructure

https://splunkbase.splunk.com/app/3067/

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...