A lot will depend on how your SOC does it's workflow. If the notable event workflow in Splunk is how security events/incidents are managed then you really don't need to do much to expand beyond it from an analyst's perspective for the meat of their work. Most other "apps" that are key outside ES itself (and it's bundle of TAs and SAs) are any other relevant TAs to ensure that the data you are putting into splunk conforms to the Common Information Model (CIM) since the CIM and the accelerated data models are the backbone of how ES will see the data in Splunk. One app I found handy, though not a security app itself, was the Lookup File Editor: https://splunkbase.splunk.com/app/1724/ for locally defined lists analysts wanted to edit that weren't the core ES asset/identities/etc... lists I would also highly recommend the newly released Knowledge Object Explorer: https://splunkbase.splunk.com/app/2871/ to better understand the sometimes complex knowledge objects that live in an ES installation But beyond some utility apps like that, it's usually best to keep an ES Search Head as pared down as you can so that there's not a bunch of apps exporting tons of knowledge objects to the whole system -- those can really start to slow down search performance. ... View more