Splunk Search

Create Splunk Use Cases and Dashboard

iremdoesthings
Loves-to-Learn

My teacher gave me this task:

"You need to apply at least 3 different use cases that we will change according to your scenario. Show various use cases on the Dashboards you create. You can refer to sample use cases on the Internet or in the Security Essentials application on Splunk." but I don't know how to do this task. He gives us an empty Splunk Server and this task.

How can I create a use-case scenario?

Thank you for your time...

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @iremdoesthings ,

I suppose that you already know Splunk and SPL, if not, let me know that I can hint some free training to start.

Anyway, as you teacher and @PickleRick hinted, the Splunk Security Essentials App. is a good starting point to find the searches for your use cases, but anyway, the real staring point is the data that you have available on your Indexer: which one do you have available?

You could analyze your data with a simple search (index=* | stats count BY sourcetype) so you can know which data source you have available and you can use.

Otherwise, in the Splunk Security Essentials App, there's a very interesting feature, that analyzes you data and says to you which searches you can implement on your data, you can find it in the app at [Data > Data Invenatry].

Ciao.

Giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

A use case in this context is typically a search returning results corresponding to some security scenario. Like finding excessive failed logins or sequence of logins from a geographically distant places in a short period of time.

You need to check what data you have available, what you want to find and think how to find it. Free Security Essentials app is indeed a good source for possible use cases.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...