Does anyone have any advice on how to use Splunk's pre-canned correlation searches within Enterprise Security and have events fire for incident review (notable event) based on new sourcetypes/data inputs? We have for example bit9 and bro logs coming into Splunk and I'd like to have some logic applied to these inputs for any anomalies, etc., so that analysts can look at this stuff while using the Enterprise Security app.
... View more
