I'm looking for a list of "out of the box" use cases that Splunk comes with - to do a gap analysis between that, and a Splunk SIEM we've taken over.
Thanks for any help,
Mark
That somewhat depends on if you are looking at Splunk Core, or specifically any of the premium apps like Splunk Enterprise Security (ES) or Splunk IT Service Intelegence (ITSI) or even Splunk UBA.
Assuming you are approaching this from a security standpoint the Splunk Security Essentials App
https://splunkbase.splunk.com/app/3435/ lists numerous ootb use cases, and the products they apply to.
Hi @marktait1971,
you could start to see in the following urls:
https://docs.splunk.com/Documentation/ES/6.0.0/Admin/Introduction
https://docs.splunk.com/Documentation/UseCases/usecases/Security/Summary
https://docs.splunk.com/Documentation/ES/6.0.0/Usecases/Overview
then this video is very useful:
https://www.splunk.com/en_us/resources/videos/splunk-enterprise-security-use-case-library.html
Ciao.
Giuseppe
Thank you - those are useful, but is there a simple list of use cases listed anywhere that you know of?
maybe this could be useful
https://docs.splunk.com/Documentation/ESSOC/1.0.48/stories/UseCase
Ciao.
Giuseppe
They are updated very frequently, and are only (to my knowledge) completely detailed in the Security Essentials App (which is updated just as frequently)
Just an addendum - they are also detailed inside ES, but unless you have access to ES, that is of less help.
That somewhat depends on if you are looking at Splunk Core, or specifically any of the premium apps like Splunk Enterprise Security (ES) or Splunk IT Service Intelegence (ITSI) or even Splunk UBA.
Assuming you are approaching this from a security standpoint the Splunk Security Essentials App
https://splunkbase.splunk.com/app/3435/ lists numerous ootb use cases, and the products they apply to.
Thank you - I found it via your link: https://docs.splunksecurityessentials.com/content-detail/