Splunk Es

revanthammineni · ‎08-02-2021

Hi Splunkers.

Could anyone give me some info on what kind of attacks I can work on based on Linux and Windows logs. I've already working on brute force attacks but my team wants me to work on other possible attacks as well. Please share some knowledge. TIA.

gcusello · ‎08-03-2021

Hi @revanthammineni,

the first thing you could do it's installing Enterprise Security Content Updates (ESCU) from Splunkbase (https://splunkbase.splunk.com/app/3449/) in this way you'll have up around 300 Use Case already available that you can enable if you have the related logs.

In addition I hint to follow the videos on YouTube and eventually to follow a training on ES Admin.

Ciao.

Giuseppe

Splunk Es

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Join the Conversation

Splunk Es

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose