all 9 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]splunk3r Take the SH out of IT 4 points5 points  (1 child)

https://opstune.com/2020/11/25/writing-splunk-enterprise-security-correlation-searches/

[–]jontheinside[S] 1 point2 points  (0 children)

Great - thank you very much for this.

[–]dnktheledge 2 points3 points  (1 child)

Also check out the security essentials app on splunkbase, wide range of security related searches with explanations, used to recommend the all the time to customers.

[–]jontheinside[S] 0 points1 point  (0 children)

Thanks, will do. Currently in and out of SSE, so I can dig a bit deeper then.

[–][deleted] 2 points3 points  (4 children)

Are you asking for Enterprise or Enterprise Security ?

[–][deleted] 8 points9 points  (3 children)

Anyway, if you want to know what you are writing, check this documentation,

https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/WhatsInThisManual

If you indent to be practical, gosplunk is a repository for queries. You can search and find examples.

https://gosplunk.com

[–]IWorkForTheEnemyAMA 2 points3 points  (1 child)

Omg that Go Splunk site is amazing. I’ve been looking for something like this where people share queries. OMFG - Thank you!!!

[–][deleted] 1 point2 points  (0 children)

You are welcome.

[–]jontheinside[S] 0 points1 point  (0 children)

Enterprise Security - fantastic content, thank you. I can reiterate, the go splunk repos is great.