Splunk Enterprise Security Introduction
This post is an attempt to help you get a better understanding of what Splunk Enterprise Security is and how it matters for the people in security domain.
The Struggle before SIEMs
Before the SIEM solutions came into picture it was really difficult for the security analysts to deal with the incidents, do the correlations and figure out the false positive and negatives, understand the overall security posture of the organisation etc. at the bottom of which were the underlying so many different tools/appliances/devices powering and protecting the organisation’s infrastructure, professionals were looking for a way to manage all these centrally and efficiently as the incidents used to consume a lot of time in the initial stages of investigation due to the variation of sources of incidents, this was only the investigation part where the breaches were getting detected in several days to months, forget about the response. SIEM solutions like Splunk ES, IBM Qradar, LogRhythm were the Industry’s answer to all this fuss going in and around the organisations.
All the big companies today are using a SIEM product to leverage their security operations, save time and effort on the security incidents, Splunk ES has emerged as the worldwide leader in this section.
Splunk Enterprise Core and Enterprise Security – The relation
Splunk Enterprise core solution is a software platform that can collect/gather data from almost any source, including metrics, logs from a variety of devices like web servers, hypervisors, containers, custom applications etc either in real time or at specific intervals. It enables you to search, monitor and analyze that data to discover powerful insights across multiple use cases like troubleshooting, IT operations, application delivery, security, industrial data etc, having all this capabilities on their platform Splunk developed and introduced a premium Security Information and Event Management (SIEM) solution in the year 2017, named Splunk Enterprise Security, basically a collection of different frameworks which runs on the Splunk Enterprise Core.
The frameworks in Splunk ES are:
- Asset and Identity Correlation – Performs asset and identity correlation for fields that might be present in an event set returned by a search.
- Notable Events- The correlation searches based on different use cases surface here, it enables to identify noteworthy incidents from events and then manage the ownership, triage process, and state of those incidents.
- Threat Intelligence- It is a mechanism for consuming and managing threat feeds, detecting threats, and alerting.
- Risk Analysis- Provides the ability to identify actions that raise the risk profile of individuals or assets, and accumulate that risk to allow identification of people or devices that perform an unusual amount of risky activities.
- Adaptive Response- Provides a mechanism for running preconfigured actions within the Splunk platform or by integrating with external applications. These actions can be automatically triggered by correlation search results or manually run on an ad hoc basis from the Incident Review dashboard.
Check out the PDF available at the link below for a crisp knowledge about these frameworks–
https://conf.splunk.com/files/2016/slides/exploring-the-frameworks-of-splunk-enterprise-security.pdf
The app ships with pre-packaged use case libraries, dashboards, correlation searches, and incident response workflows to help security teams analyze and respond to their network, endpoint, access, malware, vulnerability, and identity information. Splunk ES helps teams gain organization-wide visibility and security intelligence for continuous monitoring, incident response, SOC operations, and providing executives a window into business risk aggregations.
If you want to get yourself familiarised with Splunk Enterprise Security and understand how it can help your organisation, use the free seven day cloud trial sandbox available at Splunk , you need to create an account on https://www.splunk.com/ before you can apply for the trial.
We hope this post helped you in your quest to get a better overview of Splunk ES.
Happy Splunking!!
