The Splunk RBA Community developed by Outpost Security is amazing and full of very active members who are supportive of new users. You can sign up for the RBA Community Slack channel to ask questions on risk-based alerting, identify best practices, and interact with the community of users. See RBA community Slack channel

Additionally, you can search for solutions or ask questions on Splunk Answers, connect with helpful and fun Splunk enthusiasts through chat groups, or meet users in your local area at User Groups near you. The Community portal has everything you need to discover how to set yourself up for success with the Splunk Community.

Splunk Enterprise Security has a wide range of documentation, including tutorials, scenarios, and manuals for administrators, developers, and users.

See Splunk Enterprise Security Documentation site.

See The essential guide to risk-based alerting. This 58-page guide takes you on a step-by-step maturity journey to a successful RBA implementation with high-level explanation and hands-on examples.

For more information on deployment planning, installation, upgrade, configuration, see the product documentation:

• System Requirements in the Splunk Enterprise Security Installation and Upgrade manual.

• Install Splunk Enterprise Security in the Splunk Enterprise Security Installation and Upgrade manual.

• Planning an upgrade of Splunk Enterprise Security

• Administering Splunk Enterprise Security

• Splunk Enterprise Security tutorials

To learn more about validating ingested data so that alerting is easier and more consistent, use the Common Information model (CIM) add-on:

Overview of the Splunk Common Information Model

Review the following resources for .conf presentations, blogs, use cases, videos, and tutorials on security and RBA:

• Security Use case library on Splunk Lantern

• Primer on risk-based alerting on Splunk Lantern

• Splunk tech talks: Deep-dives for technical practitioners

• RBA resources

• Splunk blogs on security

• Splunk community

• Splunk .conf presentations

At the bottom of every page of Splunk documentation is a quick form that you can use to send us feedback.