Snort/Splunk Alerts Working Fine -- How to make good alerts?

[synodic]

I have Snort shoving JSON logs to Splunk, I see everything just dandy when I do the following in search:

 sourcetype="snort3:alert:json" 

I see many events!

However, I can have to create alerts based on suspicious activities that I already search for in Splunk.

Is there some way to load pre-set common alerts into Splunk?  Do I have to go through the task of making each alert for Splunk (eg: create alert for bad RDP logins, lengthy ICMP probes, bad FTP logins, etc.. etc..?) 

I guess what I'm asking is there a way to make my Splunk populate alert rules that are predefined or are zero day?

[isoutamo]

Hi

you should start with next apps:

• https://splunkbase.splunk.com/app/4240
• https://splunkbase.splunk.com/app/3435

Just install those into your environment with requirements (like CIM app). Then follow up instructions how to do data onboarding. If I recall right there are something ready for Snort, but it needs that you are doing snort data onboarding correctly.

r. Ismo

[synodic]

Thanks for the starting point!  I've installed the apps successfully AND the prerequisites.  I'm still getting the following errors:

I'm missing the following Data Model Accelerators that it requires:

- Network_Traffic
- Web

All the others have been enabled.  Please help!

[isoutamo]

Have you installed also CIM app (https://splunkbase.splunk.com/app/1621)? 

After that you must onboard your snort data. InfoSec expecting that it found some known eventtypes and tags at least to use that data. You can read information from docs (CIM + InfoSec + Security Essentials).

[synodic]

Unfortunately, I'm still experiencing the same errors. I'm not sure what to do at this point, I've installed all the prerequisites, read through the documentation twice.

Not sure what I'm missing.

[isoutamo]

Have you enabled acceleration for those two data models in CIM setup?