Splunk Es

revanthammineni · ‎08-02-2021

Hi Splunkers.

Could anyone give me some info on what kind of attacks I can work on based on Linux and Windows logs. I've already working on brute force attacks but my team wants me to work on other possible attacks as well. Please share some knowledge. TIA.

gcusello · ‎08-03-2021

Hi @revanthammineni,

the first thing you could do it's installing Enterprise Security Content Updates (ESCU) from Splunkbase (https://splunkbase.splunk.com/app/3449/) in this way you'll have up around 300 Use Case already available that you can enable if you have the related logs.

In addition I hint to follow the videos on YouTube and eventually to follow a training on ES Admin.

Ciao.

Giuseppe

Splunk Es

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Splunk Es

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...