splunk
Harpoon Security
Overview
Details
This TA enables rapid acquisition and parsing of Harpoon Security Event logs and provides integrations into Enterprise Security as well as workflows to enable pivoting and aggregation from other CIM compliant data sources.
This app require Common Information Model (https://splunkbase.splunk.com/app/1621/) installed and configured for worflow functionality
Memory Injection correlation search must be enabled within Enterprise Security for generation of notable events.
This app require Common Information Model (https://splunkbase.splunk.com/app/1621/) installed and configured for worflow functionality
Memory Injection correlation search must be enabled within Enterprise Security for generation of notable events.
- This app requires Common Information Model App installed and configured (https://splunkbase.splunk.com/app/1621/) for workflows to identify indexes and populate.
- Memory Injection correlation search must be enabled from within Enterprise Security to generate notable events.
Release Notes
Version 1.0.1
March 30, 2021
Added post injection attack correlation search.
Added Risk Analysis and Risk Based Alerting (RBA).
We polished up several things that ultimately ended up making the Correlation Searches work better.
Version 1.0.0
May 25, 2020
Initial Release of Splunk App for Harpoon Security. App should is applicable for install on search heads, indexers, and forwarders.
This app is CIM compliant and mapped to Change, Endpoint, Intrusion Detection, and Malware datamodels.
This app is Enterprise Security Compliant and generates notable events of process injection at endpoints.