Splunk Enterprise Security

Splunk App for Enterprise Security: How to create a threat list and test them out?

LinuxWizard
New Member

In our Splunk App for Enterprise Security server, I want to add a local threat list that lists URLs to watch through the app and populate the list with the threats. We have prebuilt lists on our server, but I don't really know how to build them. I can see them in data enrichment on the app, however I don't know of a way to test them out. Sorry I'm a bit new at Splunk. Just started two weeks ago. Still reading basic documentation.

0 Karma

mdessus_splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...