Training + Certification

How to create Splunk alerts?

ish
Explorer

i need to set email alerts for malicous activites  in Splunk 

I also need to set  all security measures  for enterprise server

Please help

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you don't have any data then you have nothing to search.  Add data then search it.

If we could add data only about malicious activities then our jobs would be much easier.  Instead, we have to add the data we have and then search it for indications of suspected malicious activity.  What data to add depends on what you have and which activities you care about.

Once you have a working search and save it as an alert then Splunk will ask what you want to do with the alert.  One of the options is to send email.  See the manual cited above.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Those are two vague statements that should be separate postings.

To create an alert, start with a search.  Find the condition that will trigger the alert, whatever that may be.  When you're happy with the search results, click the Save As link and save it as an alert.  See https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts for details.

The second question is far too broad and vague to address.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

ish
Explorer

Thanks so much for reply

I  just start learning Splunk

I want to know if i don't have any existing data  for search, Do I have to create new search?

How I add data about malicous activities as new search

how I will set alerts goes to my  email

Thank===

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you don't have any data then you have nothing to search.  Add data then search it.

If we could add data only about malicious activities then our jobs would be much easier.  Instead, we have to add the data we have and then search it for indications of suspected malicious activity.  What data to add depends on what you have and which activities you care about.

Once you have a working search and save it as an alert then Splunk will ask what you want to do with the alert.  One of the options is to send email.  See the manual cited above.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

ish
Explorer

Thanks  for well explanation and reply

I have software valid for 16 more days, I will work on it

 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>