Building Correlation Searches in Splunk Enterprise Security Companion App
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
This app is a companion app to the Build Correlation Searches with Splunk Enterprise Security Hands On Workshop based on the BOTS v4 data set.
It is designed to be installed on top of a Splunk ES instance and contains a module for the Use Case Library, complete with an Analytic Story containing Correlation Searches that users can apply to their own ES instance.
Many of these searches are derived from the SIGMA project https://github.com/Neo23x0/sigma.
The decrypt app is required for the PowerShell Encoding Correlation Search and can be found here: https://splunkbase.splunk.com/app/2655/.
It is designed to be installed on top of a Splunk ES instance and contains a module for the Use Case Library, complete with an Analytic Story containing Correlation Searches that users can apply to their own ES instance.
Many of these searches are derived from the SIGMA project https://github.com/Neo23x0/sigma.
The decrypt app is required for the PowerShell Encoding Correlation Search and can be found here: https://splunkbase.splunk.com/app/2655/.
Release Notes
Version 1.0.2
March 24, 2020
Build Correlation Searches with Splunk Enterprise Security Hands On Workshop 1.0.2
24 March 2020
Version 1.0.2
-Added an additional correlation search to the Analytic Story
-Fixed an issue where the Analytic Story would generate an error when attempting to edit from the UI
The enclosed correlation searches should work with any version of Enterprise Security but the Analytic Story function was released as part of ES 5.2 so supported Splunk versions are identified as those that support ES 5.2 and newer.