Splunk Search

Endpoint protection options that are Splunk friendly?

daniel333
Builder

All,

We're reselecting our endpoint protection for Windows Servers and Workstation. I'd like to start with solutions that speak splunk or have good Splunk apps. That is to say, good logs, CIM, tags, great apps that can go into Splunk relatively easy.

Obviously Splunk isn't the only measure of success here, but it's one element we're looking at. Any recommendations?

0 Karma

sumanssah
Communicator

I would recommend using "Windows Event Logs Analysis" app, this gives a good view of windows infrastructure

https://splunkbase.splunk.com/app/3067/

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...