Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security 7.2

[WhitneySink]

WATCH NOW!

This Tech Talk features demos around our latest release of Splunk Enterprise Security 7.2! We’ll walk through our new capabilities that deliver an improved workflow experience for simplified investigations; enhanced visibility and reduced manual workload; and customized investigation workflows for faster decision-making.

You’ll also hear from the Splunk Threat Research Team who will discuss the latest security content updates that make Splunk Enterprise Security more powerful and protect you from the latest threats.

Highlights:

• Learn about the new improvements and features requested directly from Splunk Enterprise Security users, submitted through the Splunk Ideas portal
• Simplify your workflow experience while reducing manual workloads and increasing the speed of investigation and response
• Integrate top-tier detections and defenses into your security operations using the latest security content to find and remediate threats faster

WATCH HERE!

[adepp]

Hi everyone,

Don’t forget to register for our Office Hours: Enterprise Security session on Wed, Oct 25 at 1pm PT/4pm ET. Technical Splunk experts will be there to answer questions and provide how-to guidance on all things ES.

Register here to secure your spot and submit your questions at registration!

See you there,

Baylie

[WhitneySink]

Please find materials to continue your journey below:

• Splunk Security Content for Threat Detection & Response: Q2 Roundup
• Amadey Threat Analysis and Detections
• Defending the Gates: Understanding and Detecting Ave Maria (Warzone) RAT
• Sharing is Not Caring: Hunting for Network Share Discovery
• Mockbin and the Art of Deception: Tracing Adversaries, Going Headless and Mocking APIs
• See More, Act Faster, and Simplify Investigations with Customizable Workflows from Splunk Enterprise...

[WhitneySink]

Here are a few top of mind questions from the live Tech Talk

Q. How long does it take to upgrade from 7.1.1 to 7.2.0 ?

A. It depends on your architecture and how many other components also require upgrades. The core Enterprise Security search head upgrade app runs in about 10 minutes, however backups and other app updates add to the time.

Q. Do you have any detection search to find anomaly login?

A. We have a list of detections in this analytic story: Suspicious AWS Login Activities, that cover various detections related to anomalous login activity, you can repurpose this SPL logic to a data source of your choice.

Q. Can you list the recommended steps for upgrading ES to version 7.2?

A. Please see our documentation here: https://docs.splunk.com/Documentation/ES/7.2.0/Install/Beforeupgrading

Q. My incident review looks nothing like this. How can I get this view?

A. In ES 7.2.0, follow these steps to turn on the enhanced analyst workflows on the Incident Review page:

From the Splunk ES menu bar, select Configure > General > General Settings.

Locate the card for Enhanced Incident Review Workflows.

Select Turn on to turn on the ability to use shared views, table filters, and table columns on the Incident Review page.