Splunk Es

[revanthammineni]

Hi Splunkers.

Could anyone give me some info on what kind of attacks I can work on based on Linux and Windows logs. I've already working on brute force attacks but my team wants me to work on other possible attacks as well. Please share some knowledge. TIA.

[gcusello]

Hi @revanthammineni,

the first thing you could do it's installing Enterprise Security Content Updates (ESCU) from Splunkbase (https://splunkbase.splunk.com/app/3449/) in this way you'll have up around 300 Use Case already available that you can enable if you have the related logs.

In addition I hint to follow the videos on YouTube and eventually to follow a training on ES Admin.

Ciao.

Giuseppe