Get started with Splunk Enterprise Security
Use Splunk Enterprise Security to triage, investigate, and respond to security incidents. You can identify and remediate findings and investigations while collaborating with others on your team.
Use Splunk Enterprise Security to complete the following tasks:
- Triage findings. See Triage findings and finding groups in Splunk Enterprise Security.
- Start investigations. See Start investigations in Splunk Enterprise Security.
- Respond to investigations with response plans. See Respond to investigations with response plans in Splunk Enterprise Security.
- Automate your investigation response. See Automate your investigation response with actions and playbooks in Splunk Enterprise Security.
- Analyze risk with risk-based alerting. See Analyze risk with risk-based alerting in Splunk Enterprise Security.
- Investigate observables with threat intelligence management. See Investigate observables related to an investigation in Splunk Enterprise Security.
To get started, select the Mission Control tab in Splunk Enterprise Security, and then select a finding and start investigating.
Splunk Enterprise Security terminology
The main components of Splunk Enterprise Security each play a role in delivering security triage, investigation, and response. Some of these components are present in other Splunk security software.
| Term | Definition |
|---|---|
| Analyst queue | A list of findings and investigations that analysts can triage. Intermediate findings are not displayed in the analyst queue. |
| Detection | A scheduled correlation search that runs analytics on Splunk events, third-party alerts, or findings and generates findings, intermediate findings, or finding groups. |
| Detection editor | An editor to configure event-based and finding-based detections. Using the detection editor, you can also configure time range to run the detection searches, configure adaptive response actions, and so on. |
| Entity | Asset, identity, user, or device in your network that generates machine data. Entities are the subject of suspicious, anomalous, or malicious activity and help to identify potential security threats. Entities are normalized in lookups against known assets and identities using the Assets and Identities framework in Splunk Enterprise Security. Entities also carry weighted risk scores that are updated automatically in real time. |
| Event | A contributing event or raw data associated with an investigation or finding. It can represent the finding itself or a series of activities that resulted in the creation of the finding. |
| Event-based detection | A type of detection that reviews raw events ingested into the Splunk platform and creates findings, which might or might not indicate a potential security threat. Event-based detections generate findings or intermediate findings depending on how the user configures the detection. |
| Finding | One or more anomalous incidents or alerts generated by event-based detections. A finding contains all the relevant information about what was observed and which entity was impacted. |
| Finding-based detection | A type of detection that reviews the findings in the risk index and the notable index for anomalous events and threat activities and uses an aggregation of findings impacting a single entity, or other group type and criteria, to generate finding groups that indicate a security risk. |
| Finding group | A group of findings and intermediate findings created by finding-based detections. Finding groups can be manually included in an investigation and triaged by the SOC. Finding groups are stored in KV Store collections. |
| Intermediate finding | A record or observation created by event-based detections that indicate an anomaly but might not be a standalone security incident. Intermediate findings in conjunction with other findings might be used as input by advanced finding-based detections to discover potential security incidents with high fidelity and confidence. Intermediate findings might look identical to findings based on the data stored in the index. However, intermediate findings are not displayed in the analyst queue and are not triaged by analysts. The style and format of an intermediate finding is identical to that of a traditional finding and contains fields such as timestamp, key/value pairs, an entity, risk score, threat objects, and other metadata. |
| Investigation | A case that has been manually or automatically flagged and is displayed in the analyst queue of the Mission Control page in Splunk Enterprise Security. Investigations are a collaborative process for security personnel such as analysts, SOC managers, automation engineers, security architects and so on to identify, collect, and examine findings or finding groups. |
| Investigation type | A category of investigations that share common characteristics, such as source or severity. After creating an investigation type, you can associate the investigation type with a response plan to automate and personalize your response workflow. |
| Note | Additional information such as PDFs, slide decks, reference materials, screenshots, extracts of log files, notes, Splunk events, email messages, and so on that can be attached to an investigation or finding. |
| Threat list | A list of threat-indicators published by your threat intelligence management (cloud) data sources for use in Splunk Enterprise Security threat-matching searches and investigation enrichment. You can set up multiple threat lists to pinpoint responses or target data to specific tools in your cybersecurity setup. |
| Response plan | A template of guidelines for analysts to follow so that they can provide a standardized response for investigations of the same type. You can use response plans provided by Splunk Enterprise Security, such as NIST 800-61 or Vulnerability Disclosure, or you can create your own custom response plan. |
Differences in navigation menu options in Splunk Enterprise Security version 8.6 and higher
In Splunk Enterprise Security version 8.6 and higher, user interface navigation menu options have changed to offer streamlined user workflows and consistency across features.
Following are some of the main differences in the user interface (UI) between Splunk Enterprise Security version 8.6 and prior versions:
-
Side panel to access investigation workflows.
-
Icons for navigation menu items such as Anaytics, Security content, Configure, and Mission Control.
-
Secondary, collapsible side panels to access the Analyst Queue, Threat Intelligence Management, Exposure Analytics, Detection Studio, and so on.
-
SOAR integration with Splunk Enterprise Security is viewable in the Analyst queue page.
Side panel to access investigation workflows
In Splunk Enterprise Security versions lower than 8.6, a top navigation panel is available to navigate the investigation workflows as shown in the following figure:
In Splunk Enterprise Security versions 8.6 and higher, a side panel is available to navigate the investigation workflows as shown in the following figure:
Icons for product features
In Splunk Enterprise Security versions lower than 8.6, no icons are available for various product features.
In Splunk Enterprise Security versions 8.6 and higher, icons are available to for product features as shown in the following figures:
Analytics has a chartline icon:
Security content has a bookshelf icon:
Configure has a cog icon:
Mission Control has a shield keyhole icon:
Any new collection that does not match a known label has a fallback icon:
Secondary, collapsible side panels to access product features
In Splunk Enterprise Security versions lower than 8.6, a secondary top navigation panel is used to access the Analyst Queue, Threat Intelligence Management, Exposure Analytics, Detection Studio, and so on.
In Splunk Enterprise Security versions 8.6 and higher, secondary, collapsible side navigation panels are used to access the Analyst Queue, Threat Intelligence Management, Exposure Analytics, Detection Studio, and so on as shown in the following figure:
SOAR integration with Splunk Enterprise Security is viewable in the Analyst queue page
In Splunk Enterprise Security versions lower than 8.6, SOAR integration with Splunk Enterprise Security is displayed as a Bell icon at the top right corner as shown in the following figure:
In Splunk Enterprise Security versions 8.6 and higher, SOAR integration with Splunk Enterprise Security is displayed in the Analyst queue page as shown in the following figure: