i need to set email alerts for malicous activites in Splunk
I also need to set all security measures for enterprise server
Please help
If you don't have any data then you have nothing to search. Add data then search it.
If we could add data only about malicious activities then our jobs would be much easier. Instead, we have to add the data we have and then search it for indications of suspected malicious activity. What data to add depends on what you have and which activities you care about.
Once you have a working search and save it as an alert then Splunk will ask what you want to do with the alert. One of the options is to send email. See the manual cited above.
Those are two vague statements that should be separate postings.
To create an alert, start with a search. Find the condition that will trigger the alert, whatever that may be. When you're happy with the search results, click the Save As link and save it as an alert. See https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts for details.
The second question is far too broad and vague to address.
Thanks so much for reply
I just start learning Splunk
I want to know if i don't have any existing data for search, Do I have to create new search?
How I add data about malicous activities as new search
how I will set alerts goes to my email
Thank===
If you don't have any data then you have nothing to search. Add data then search it.
If we could add data only about malicious activities then our jobs would be much easier. Instead, we have to add the data we have and then search it for indications of suspected malicious activity. What data to add depends on what you have and which activities you care about.
Once you have a working search and save it as an alert then Splunk will ask what you want to do with the alert. One of the options is to send email. See the manual cited above.
Thanks for well explanation and reply
I have software valid for 16 more days, I will work on it