Identifying Splunk Enterprise Security use cases and data sources

Splunk Enterprise Security (ES) includes a broad library of default detections, organized into analytic stories, that cover a variety of use cases. Some common use cases include:

• Detecting malware
• Finding data exfiltration
• Monitoring privileged and non-privileged users
• Detecting brute force activity (local and cloud)
• Detecting advanced threats
• Analyzing traffic over time by action
• Finding TOR traffic
• Detecting cleared Windows event logs
• Detecting excessive user account lockouts
• Detecting common ransomware notes
• Detecting excessive account lockouts from an endpoint
• Detecting short-lived Windows accounts
• Detecting remote desktop network brute force attempts
• Detecting suspicious user email forwarding in Microsoft 365
• Detecting remote process instantiation through WMI
• Detecting hosts connecting to dynamic domain providers

To browse use cases in ES, select Configure > Content > Use Case Library. You can filter use cases by category, security framework such as MITRE ATT&CK, data model, or keyword, and open each analytic story to see its detections. A great way to begin is by turning on a few detections and adjusting them to fit your specific environment. To learn more, see Implement security use cases using the Use Case Library in Splunk Enterprise Security.

Other places you can find ideas for use cases include:

• Splunk ES Content Update app: The Splunk Threat Research Team (STRT) develops and maintains this app, which delivers analytic stories in the Use Case Library and is updated frequently with timely detections. It's a best practice to update it often. ES prompts you when a new version is available.
• Splunk Security Essentials: This app helps you explore security use cases, discover your current status, and identify gaps in your security posture. Find the most suitable security content to start addressing threats and challenges. Splunk Security Essentials also has a data inventory tool to perform data introspection on available data sources.
• Splunk Lantern: Lantern has a wealth of use cases and product tips written by Splunk experts to help you optimize your use of ES.
• MITRE ATT&CK: This framework can help you find gaps in your coverage and areas you need to implement. Use MITRE ATT&CK to see how use cases map to adversary tactics, techniques, and procedures (TTPs).
• Risk-based alerting (RBA): RBA in ES, through finding-based detections that group findings by entity, can also help you implement use cases more efficiently.

Some additional resources to help you develop use cases are:

• Video: Enterprise Security SIEM use case library
• .conf session: The beginner's guide to security monitoring for enterprises