Splunk Enterprise Security

What are the key details I should pay attention to when rewriting searches to correlation searches?

test_qweqwe
Builder

Hello all!
What should I do or what should I know, (maybe some tricks or magic) if I need to quickly rewrite my searches to correlation searches that will work with CIM Data Models? My SPL skills are limited when it comes to correlation searches & notable events (even with documentation).

Maybe, what should I pay attention when I will rewrite them? Maybe it's not as difficult as it seems to me after documentation 😄

0 Karma
1 Solution

jgbricker
Contributor

Explore using data models and tstats. Searches should be fast running. Likely want to keep to 25 or less overall. Depends on what you want ES to do for you. Correlation searches will generate saved searches that are linked and have -rule at the end. Think of ES as a framework. Learn what searches are needed for the dashboards you want to use. Unfortunately learning ES and knowing what searches you need is not easy. It’s a journey.
Check out the Splunk security essentials app which has 60+ examples. There is also one for PCI and Ransomware

https://splunkbase.splunk.com/app/3435/

Check out Splunk conf talks around ES.

I think my favorite talk was Doug Browns “The Art of Detection with Enterprise Security”.

http://conf.splunk.com/sessions/2017-sessions.html

his session - http://conf.splunk.com/sessions/2017-sessions.html#search=art%20of%20detection&

View solution in original post

jgbricker
Contributor

Explore using data models and tstats. Searches should be fast running. Likely want to keep to 25 or less overall. Depends on what you want ES to do for you. Correlation searches will generate saved searches that are linked and have -rule at the end. Think of ES as a framework. Learn what searches are needed for the dashboards you want to use. Unfortunately learning ES and knowing what searches you need is not easy. It’s a journey.
Check out the Splunk security essentials app which has 60+ examples. There is also one for PCI and Ransomware

https://splunkbase.splunk.com/app/3435/

Check out Splunk conf talks around ES.

I think my favorite talk was Doug Browns “The Art of Detection with Enterprise Security”.

http://conf.splunk.com/sessions/2017-sessions.html

his session - http://conf.splunk.com/sessions/2017-sessions.html#search=art%20of%20detection&

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...