Splunk Enterprise Security

Splunk Enterprise Security: Why are all my notable events showing "0"?

jgorman_THG
Explorer

Hello,

Under security posture, all my notable events are showing 0 and I am not sure if it is working but we just haven't had a notable event, or if it isn't working.

Can someone tell me how I can confirm that this part of ES is working?

Thanks,

JG

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Hello @jgorman_THG,

I'd check a couple things:
* Are there notable events on incident review, but not security posture?
* If there are no notable events on incident review or on security posture, make sure that you have correlation searches enabled. Check the Content Management page (Configure > Content Management).

Let me know what you find on incident review and content management!

jgorman_THG
Explorer

Hi!

Looks like the correlation searches were not enabled.

Am I safe to enable all of them? Do I need to make any changes?

Thanks,

JG

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Hello JG,
Do not enable all of them, you only want to enable the ones that fit your security use cases, and the data that you have in Splunk Enterprise Security. For example, if you have endpoint logs and care about malware infections, you can enable the correlation searches that pertain to malware activity detection. You have to understand the data in your system, then make a decision about which correlation searches to enable (and thus which alerts your analysts should see).
See more here: http://docs.splunk.com/Documentation/ES/4.5.0/User/ConfigureCorrelationSearches (this advice mostly applies even if you're not running 4.5.0)

Let me know if you have any questions!
Thanks,
Sarah

jgorman_THG
Explorer

Hi,

Thanks a lot for your help.

So I've activated them and under activities I can see that the jobs are running, but they're all coming up with '0' results.

Under the security domains, there is data coming in.

Is it possible I just haven't had any notable events in the time since I activated them?

Thanks,

JG

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Hello JG,

That is possible. One thing you could also check is the Content Profile dashboard to see which data models have data in them, and then which knowledge objects you can use with those data models.

  • If you enabled correlation searches for data models without accelerated data, you still won't see notable events.
  • If the correlation searches (identified on the content profile page by - - Rule) are enabled for data models that have data, then it's likely that you don't have any notable events since you enabled the correlation searches.

Let me know if that helps!
Thanks,
Sarah

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...