Wanted to recap the questions from the live Tech Talk. Enjoy. Q: For this situation described, can you please let us know what log sources need to be ingested into Splunk / Splunk UEBA? A: Most organizations will start with traditional sources like web proxy, Auth, IDS, AV, firewall, etc. When you align to a CSF like MITRE ATT&CK, data sources like SYSMON, EDR, DNS, etc provide a much greater portion of coverage. In general, if the data source provides investigative worthy context to an analyst, it's fair game. Q: Can SA-RBA be used without Enterprise Security? A: Yes. Q: Are these rules prepackaged into ES ? A: You can use rules packaged in ES, Splunk Security Essentials, or Enterprise Security Content Updates. There is also a community repo located at https://rbaallday.com. Q: Where are the correlation searches located ? A: The searches, macros, dashboards, etc that were used in this demo are all located here: https://rbaallday.com. General content that can be modified for usage with RBA can also be found in Enterprise Security, Splunk Security Essentials App, or the Enterprise Security Content Update App.
... View more