Splunk ES Content Update

Overview

Details

The Splunk ES Content Update (ESCU) app delivers pre-packaged Security Content. ESCU provides regular Security Content updates to help security practitioners address ongoing time-sensitive threats, attack methods, and other security issues.

Security Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques.

The analytic stories and their searches are also available at https://github.com/splunk/security-content.

For more information please visit the Splunk ES Content Update user documentation.

Release Notes

Version 3.0.9

Nov. 10, 2020

https://docs.splunk.com/Documentation/ESSOC

Version 3.0.8

Oct. 20, 2020

https://docs.splunk.com/Documentation/ESSOC

Version 3.0.7

Sept. 21, 2020

Release notes: https://docs.splunk.com/Documentation/ESSOC

Version 3.0.6

Aug. 28, 2020

Release notes: https://docs.splunk.com/Documentation/ESSOC

Version 3.0.5

Aug. 5, 2020

Release notes: https://docs.splunk.com/Documentation/ESSOC

3,870

Installs

28,147

Downloads

Share Subscribe LOGIN TO DOWNLOAD

Version

Built by

Splunk Inc.