Getting Started with Security

Splunk Enterprise Security (ES) solves a wide range of security analytics and operations use cases including continuous security monitoring, advanced threat detection, compliance, incident investigation, forensics and incident response. Splunk ES delivers an end-to-end view of organizations’ security postures with flexible investigations, unmatched performance, and the most flexible deployment options offered in the cloud, on-premises or hybrid deployment models. Splunk ES enables you to:

Get started with Splunk for Security with Splunk Security Essentials (SSE). Explore security use cases and discover security content to start address threats and challenges.

SA-Investigator is an extension that integrates with Splunk Enterprise Security. It provides a set of views based on the asset, identity or file/process values. Tabs for individual data models like malware, network traffic, certificates are set up for easy viewing and allow the analyst to pivot between these views on a specific entity without having to open multiple dashboards and enter in criteria to start a search. Workflow actions that allow pivoting from Incident Review are also included.

This is a Splunk application containing several hunting dashboards and over 120 reports that will facilitate initial hunting indicators to investigate.

This app is used to supplement your data with information from VirusTotal. The custom command ` | virustotal ` (bundled with this app) uses the `https://www.virustotal.com/vtapi/v2/file/report` endpoint to communicate with the VirusTotal API.

TruSTAR integration for TruSTAR + Enterprise Security Customers.

This app integrates with CrowdStrike OAuth2 authentication standard to implement querying of endpoint security data

This app supports email ingestion and various investigative actions over IMAP

This app integrates with JIRA to perform several ticket management actions

This app connects to Office 365 using the MS Graph API to support investigate and generic actions related to the email messages and calendar events

This app provides the ability to send email using SMTP

This app integrates with Splunk to update data on the device, in addition to investigate and ingestion actions

This app supports executing investigative actions to analyze files and URLs on Joe Sandbox

This app supports various identity management actions on Okta

This app supports executing various endpoint-based investigative and containment actions on Carbon Black Response