Splunk Enterprise Security

Confirm data is in Splunk Enterprise security

iherb_0718
Path Finder

Hi splunkers,

I run splunk cloud and recently worked with Support to install Splunk Enterprise Security. 

Within splunk enterprise security how do I confirm that it is correlating all of my indexes?  The reason for asking is that I am not seeing any notable events.  I assume by default, splunk enterprise, out of the box, would see all my indexes and correlate to it's pre-built alerts. 

Labels (1)
0 Karma
1 Solution

scelikok
Champion

Hi, @iherb_0718

On default install, all correlation searches are disabled. You should enable the ones that works for your ingested data at Configure > Content > Content Management page. You should also check if acceleration enabled for the data models that may have CIM complaint data at  (this should already have been done before installation of ES). 

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
Champion

@iherb_0718, they may work but it is best practice review, test and tune (if needed) them before enable. This  will help you to have less false positive alerts and also prevent unnecessary load.  

 

If this reply helps you, upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma

iherb_0718
Path Finder

Sceilikok,  

Thank you. Yes the data models for cim compliant data have acceleration enabled.  I need to go enable the alerts in content management.  For the most part, should those alerts work out of the box or do I need to drill into them and tune it?  

0 Karma

scelikok
Champion

Hi, @iherb_0718

On default install, all correlation searches are disabled. You should enable the ones that works for your ingested data at Configure > Content > Content Management page. You should also check if acceleration enabled for the data models that may have CIM complaint data at  (this should already have been done before installation of ES). 

If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!