Binary Defense

The Binary Defense app provides a centralized repository of knowledge objects that support Binary Defense's detection rules running in customer Splunk environments. This foundation app contains macros, lookups, and field normalizations that are shared across all Binary Defense detections deployed in the environment. The knowledge objects are configured with global sharing, making them accessible to correlation searches in any app, including Splunk Enterprise Security. The app serves as a prerequisite component for Binary Defense's security content, ensuring consistent data normalization and lookup functionality across all detection rules. It includes an Overview dashboard for monitoring the app's operational status.