Part 2: Create a correlation search

After you plan the use case that the correlation search covers, create the search.

Create a search

To create a correlation search, start on the Content Management page.

  1. From Splunk Home, select Splunk Enterprise Security.
  2. Select Configure > Content > Content Management.
  3. Select Create New Content > Correlation Search to open the correlation search editor.
  4. In the Search Name field, type Excessive Failed Logins - Tutorial.

    Note: Correlation search names cannot be longer than 83 characters. However, if you include the string prefix, such as "Threat - " and the string suffix such as "-Rule" to the correlation search name, the maximum character count for correlation searches is 99 characters.

    Note: Splunk Enterprise Security supports only support correlation searches ending with the string suffix "-Rule".
  5. In the App drop-down list, select SA-AccessProtection as the app where you want the correlation search to be stored. Choose an app context that aligns with the type of search that you plan to build. If you have a custom app for your deployment, you can store the correlation search there.
  6. In the UI Dispatch Context drop-down list, select None. This is the app used by links in email and other adaptive response actions. The app must be visible for links to work.
  7. In the Description field, type a description of what the correlation search looks for, and the security use case addressed by the search. For example, Detects excessive number of failed login attempts (this is likely a brute force attack).
    This screen image shows the excessive failed logins tutorial search with the search name, application context, UI dispatch context, and description fields completed.

    Note: If you disable or remove the app where the search is stored, the correlation search is disabled. The app context does not affect how or the data on which the search runs.

Next Step

Part 3: Create the correlation search in guided mode.