Splunk Enterprise Security

Where can I find a list of the standard use cases Splunk comes with?

marktait1971
Explorer

I'm looking for a list of "out of the box" use cases that Splunk comes with - to do a gap analysis between that, and a Splunk SIEM we've taken over.

Thanks for any help,

Mark

0 Karma
1 Solution

nickhills
Ultra Champion

That somewhat depends on if you are looking at Splunk Core, or specifically any of the premium apps like Splunk Enterprise Security (ES) or Splunk IT Service Intelegence (ITSI) or even Splunk UBA.

Assuming you are approaching this from a security standpoint the Splunk Security Essentials App
https://splunkbase.splunk.com/app/3435/ lists numerous ootb use cases, and the products they apply to.

If my comment helps, please give it a thumbs up!

View solution in original post

marktait1971
Explorer

Thank you - those are useful, but is there a simple list of use cases listed anywhere that you know of?

0 Karma

gcusello
SplunkTrust
SplunkTrust

maybe this could be useful
https://docs.splunk.com/Documentation/ESSOC/1.0.48/stories/UseCase

Ciao.
Giuseppe

0 Karma

nickhills
Ultra Champion

They are updated very frequently, and are only (to my knowledge) completely detailed in the Security Essentials App (which is updated just as frequently)

Just an addendum - they are also detailed inside ES, but unless you have access to ES, that is of less help.

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

That somewhat depends on if you are looking at Splunk Core, or specifically any of the premium apps like Splunk Enterprise Security (ES) or Splunk IT Service Intelegence (ITSI) or even Splunk UBA.

Assuming you are approaching this from a security standpoint the Splunk Security Essentials App
https://splunkbase.splunk.com/app/3435/ lists numerous ootb use cases, and the products they apply to.

If my comment helps, please give it a thumbs up!

marktait1971
Explorer

Thank you - I found it via your link: https://docs.splunksecurityessentials.com/content-detail/

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...