...nalysis results going forward?
Any advice given here would be gratefully recieved.
Sheamus.
Edit:
This question is for SplunkEnterpriseSecurity 4.0.1.
...EnterpriseSecuritySuite) from etc/shcluster/apps to etc/apps folder Ran the upgrade command – (/opt/splunk/bin/splunkinstall app ./splunk-enterprise-security_620.spl -update 1) Ran the essinstall command as per the in...
...pdated by +20. and an alert should be triggered only if risk_score>=30. Can I accomplish it writing a correlation search? Or there is another way of doing it, please suggest.
