Splunk Events

Splunk Intelligence Management for Splunk SOAR

While Splunk SOAR playbooks automate security actions, they become even more powerful and easy to use with the addition of Splunk Intelligence Management (formerly TruSTAR). Tune in to learn how to obtain prepared and normalized intelligence from internal and external sources for faster triage and more streamlined playbooks.

Intelligence Management with Splunk + TruSTAR

Manual vetting and data from multiple sources cause analysts to waste much of their time data wrangling, taking time away from alerts that matter the most. Analysts need the ability to normalize and enrich multiple data sources for an objective view of security events.

The TruSTAR Unified App for Splunk Enterprise and Enterprise Security helps security professionals analyze notable events and leverage intelligence to quickly understand threat context and prioritize and accelerate triage.

Tune in to this Tech Talk to learn how to:

• Customize data ingest preferences using TruSTAR Indicator Prioritization Intel Workflows
• Automatically download observables into Splunk KV stores
• Enrich and prioritize notable events in Splunk Enterprise Security

Identify and address security event logging gaps with Splunk UBA

Tune in to this Tech Talk to learn about how Splunk UBA allows you to identify blind spots in security event logging, troubleshoot logging right at the source and find advanced detections with available data sources. See more follow up resources on our community discussion site.

Playbook: Suspicious Email Domain Enrichment

Tune in to the Tech Talk to learn about a new community playbook for Splunk Phantom to help enrich suspicious email events. This playbook focuses specifically on domain names contained in the ingested email, and it uses Cisco Umbrella Investigate to add the risk score, risk status and domain category to the event in Phantom. When an analyst is assigned an event, this will allow faster recognition of the purpose of the email, and the domain enrichment will also provide a connection point to take further action on the output. See more follow up resources on our community discussion site.

An AWSome Use Case for Splunk Phantom: Tackling AWS Security Automation

Tune in to this Tech Talk to learn a new use case on how to use Splunk Phantom in your IAAS environment, how you can better monitor your AWS environment with automation and Splunk Phantom’s ability to turn AWS findings into action.. See more follow up resources on our community discussion site.

Test Your SIEM with Splunk's Attack Data Repository

Tune in to this Tech Talk to learn how your organization can use attack datasets to evaluate the strengths and weaknesses of your SIEM correlation searches. Attack datasets consist of real datasets with real attacks generated by the attack_range. These datasets are broken down by techniques and tactics according to the MITRE ATT&CK matrix. See more follow up resources on our community discussion site.

Playbook: GCP Unusual Service Account Usage

In today’s new Splunk SOAR (formerly known as Splunk Phantom) Community Playbook Tech Talk, we will show how a Splunk Enterprise search can trigger automated enrichment, an analyst prompt, and rapid response actions to prevent damage caused by malicious account access. See more follow up resources on our community discussion site.

Adaptable Incident Response with Splunk Phantom Modular Workbooks

Tune in to this Tech Talk to learn how Phantom can dynamically add tasks to your workbooks, understand why workbooks might need to adapt during investigations, and see modular workbook development in action and utilize these examples in your organization. See more follow up resources on our community discussion site.

RBA Investigations at Machine Speed with Splunk Phantom

Tune in to this Tech Talk to learn how to incorporate threat indicators to your RBA strategy, build an extensible Phantom playbook framework for new use-cases, and automate analyst information gathering steps. See more follow up resources on our community discussion site.

Protect Against Crypto-Jacking Malware with Strong DevSecOps Practices and Splunk

Tune in to the Tech Talk to learn how to monitor ephemeral cloud workload instances in real-time for anomalies, detect, alert and auto-remediate Cryptojacking malware with Splunk’s SIEM/SOAR, and bolster SIEM security use cases with real-time observability metrics. See more follow up resources on our community discussion site.

Splunk SOAR Playbook – Malware Triage with Crowdstrike and Splunk Phantom

Tune into the Tech Talk to learn about the combination of Crowdstrike and Splunk Phantom that allows for a smooth operational flow from detecting endpoint security alerts to operationalizing threat intelligence and automatically taking the first few response steps – all in a matter of seconds. See more follow up resources on our community discussion site.

Splunk Phantom: Putting the Fun in Custom Function

Tune in to this Tech Talk to learn how Splunk delivers custom code blocks to you with Phantom, how to centrally manage and reuse your code so you never have to reinvent the wheel again, how you can use custom functions as building blocks to scale out automation within your organization, and how to action custom functions with a live demo.. See more follow up resources on our community discussion site.

ES and ITSI Sitting in a Tree: How to use Notable Events to make Security and IT Collaboration Better

Tune into the Tech Talk to learn how to reduce your MTT-Everything knock down silos, and link Security and ITO together to increase velocity, while increasing visibility, and becoming more security minded. See more follow up resources on our community discussion site.

Best Practices for Maturing your SOC from Splunk Professional Services: Technology

SOCs need to evaluate their technological strengths and weaknesses to position themselves for success. The ability to proactively use your tools to identify discrepancies in your environment helps ensure that someone else won’t identify them for you. In this Tech Talk learn how to identify the necessary data sources to ingest to cover essential use cases. You’ll also learn about our risk reduction framework and how it can accelerate your maturity level and accelerate time to value. See more follow up resources on our community discussion site.

Super Speed with Phantom Slash Commands

Tune into the Tech Talk to learn how Slash Commands speed up investigations, how to quickly pivot and execute actions, all within the CLI, and to see how Slash Commands and Phantom save you time and effort. See more follow up resources on our community discussion site.

Cloud Data Modeling for Security

Tune in to this Tech Talk to learn about normalizing data from different cloud vendors, the difference between perimeter and cloud security posture, and Splunk tools to achieve vendor wide security monitoring, detection and defense. See more follow up resources on our community discussion site.

Operationalize MITRE ATT&CK™ with Risk Based Alerting (RBA)

Tune in to this Tech Talk to learn about how Splunk Risk Based Alerting allows you to scale existing analysts to include more data/analytics, increase your true positive rates, and improve the effectiveness of your SOC. See more follow up resources on our community discussion site.

What’s New in Splunk Enterprise Security 6.6

Join the Splunk Enterprise Security product team to learn more about the newest capabilities available in Enterprise Security 6.6. Check out the latest enhancements in Risk-Based Alerting, an innovative way to detect and respond to advanced threats that greatly reduces alert fatigue. And we’ve also added new Cloud Security Monitoring capabilities to support shared storage service. See how the latest improvements in Enterprise Security 6.6 can help you drive productivity and efficiency in your SOC while securing your cloud infrastructure. Tune into this Tech Talk for a short demo of the new RBA and Cloud Security Monitoring enhancements available in ES 6.6. See more follow up resources on our community discussion site.

Understanding Phantom's JOIN Logic

Tune into the Tech Talk to learn what may cause a playbook to stop running unexpectedly and how to fix it, how to use the join logic effectively, and how to properly use Phantom join logic in a live demo. See more follow up resources on our community discussion site.

Best Practices for Maturing your SOC from Splunk Professional Services

Tune in to this Tech Talk to learn how to determine your current maturity level and discover the required steps to reach the next level in maturity, see how Splunk Security Maturity Framework can accelerate time-to-value, and discover how to tie progress to outcomes in order to maximize value. See more follow up resources on our community discussion site.

Splunk Phantom App Building the Easy Way

This Tech Talk will walk you through the open source Phantom Test Harness you can use to greatly simplify the Phantom App building/testing process. See more follow up resources on our community discussion site.

Detecting Account Takeover (ATO) Fraud (Retail Focus)

Tune into the Tech Talk to learn typical data sources to ingest and analyze, how to detect warning signs in two major stages of account takeovers, and how to use visualizations to uncover unusual connections and relationships. See more follow up resources on our community discussion site.

Risk-Based Alerting & Enterprise Security

Tune in to this Tech Talk to learn how to improve true positive rates, detect complex threats faster, and streamline investigations with richer context. See more follow up resources on our community discussion site.

Best Practices for Maturing your SOC from Splunk Professional Services: People

Ensuring your SOC has the right folks in the right roles is critical to success. Our Splunk Professional Services team has determined the essential roles every SOC needs to stay ahead of threats. Providing your team with the right tools and training helps ensure continued success in the constantly changing security landscape. Join this Tech Talk to learn best practices to support the foundational piece of every SOC: its people. See more follow up resources on our community discussion site.

Finding the Right Security Content with Splunk Security Essentials

Tune into this Splunk Security Essentials Tech Talk and learn how to navigate the Security Content Library, bookmark and deploy security detections and playbooks, and create your own custom detection searches with metadata tags. See more follow up resources on our community discussion site.

Best Practices for Maturing your SOC from Splunk Professional Services: Process

Clear processes play a major role in the success of high-performing SOCs. Crystal clear governance and workflow communications are vital to ensuring your SOC can respond quickly in worst case scenarios. Join this Tech Talk to learn best practices about reporting and metrics for dashboards and visualizations. You’ll also learn how to integrate risk analysis into your overall strategy to elevate your security operations. See more follow up resources on our community discussion site.

Splunk SOAR Playbooks: Conducting an Azure New User Census

Tune in to the Tech Talk to learn how to get started with an account monitoring use case, how our newest community playbook initiates a scheduled review of new accounts created in Azure Active Directory each week, and how your security team should have a good understanding of the frequency and common attributes of newly created accounts. See more follow up resources on our community discussion site.

Online CC Skimming

Tune into the Tech Talk to learn how to detect digital credit card fraud and protect your customers and data from theft effectively. See more follow up resources on our community discussion site.

7 Tips To Boost Performance of Your Splunk Enterprise Security Operations

Tune in to this Tech Talk to learn how to optimize CPU and Memory usage to achieve considerable costs savings, how the built-in monitoring console and Enterprise Security auditing page can provide better visibility into how your SIEM is performing, and how to empower your team with bottleneck root cause analysis and performance tuning skills to scale your ES operations. See more follow up resources on our community discussion site.

Splunk Connect for Syslog: Ingest Security Data

Tune in to the Tech Talk to learn the challenges historically associated with Syslog data ingestion, see how easy it is to use Splunk Connect for Syslog in your organization, and get access to resources to help your team ingest syslog data. See more follow up resources on our community discussion site.

Get Started to be PCI Compliant

Tune in to the Tech Talk to better prepare for a PCI DSS assessment, define your cardholder data environment, demonstrate compliance with controls within the cardholder data environment, remediate any gaps in compliance, report on that compliance, and continuously monitoring and remediating gaps to maintain compliance. See more follow up resources on our community discussion site.

Splunk SOAR Playbook – Finding and Disabling Inactive Users on AWS

Tune in to the Tech Talk to learn about the importance of regularly checking inactive user accounts within your organization, how to automate the process of checking for these users, and how these Splunk Phantom playbooks work together to protect your AWS environment. See more follow up resources on our community discussion site.

Detect SolarWinds Cyberattack with Splunk Enterprise

Tune into the Tech Talk to learn how to onboard and search for Threat Indicators in your Splunk environment to start detecting SolarWinds related malware, start detecting Sunburst malware activity using Splunk by reviewing and updating your log types ingested into Splunk, then examine DNS, network, and host traffic logs, and start detecting Supernova webshell malware by examining results of vulnerability scans, hashes and proxy logs. See more follow up resources on our community discussion site.