Skip to main content
Lantern Home

 

Splunk Lantern

Configuring and optimizing Enterprise Security

  1. Last updated
  2. Save as PDF

After your data is onboarded, you can configure Splunk Enterprise Security (ES) so that its detections, findings, and investigations reflect your environment. This includes adding asset and identity data, setting up roles, enriching data with threat intelligence, and turning on and tuning detections.

Adding asset and identity data

Adding asset and identity data is a best practice and is required for effective use of ES. ES correlates asset and identity information with events at search time to enrich your data and give analysts context about the entities in each finding. You can register asset and identity data in the following ways:

  • Automatically register asset and identity data using entity discovery in Exposure Analytics. In most cases, this is the preferred method.
  • Manually register asset and identity data on the Asset and Identity Management page.
  • Use LDAP to register asset and identity data.
  • Use your cloud service provider data to register asset and identity data.

For detailed information on each method, see Add asset and identity data to Splunk Enterprise Security. To learn more about how the framework works, see Using the Splunk Enterprise Security assets and identities framework.

If Professional Services handled your installation and configuration, the process of adding asset and identity data has already been started for you.

Configuring users and roles

ES adds three roles to the default roles provided by the Splunk platform. These roles allow an administrator to assign access to specific functions in ES based on the tasks each user performs:

  • ess_user: For security directors who review the security posture, protection centers, and audit dashboards, but don't manage findings or investigations.
  • ess_analyst: For security analysts who triage findings and work investigations on the Mission Control page. This role inherits ess_user and adds the ability to create, edit, and own findings and investigations.
  • ess_admin: A container of capabilities that ES provides to the platform admin role. Don't assign it to users. Use the admin role, or sc_admin in Splunk Cloud Platform, to administer ES.

To learn more about each role and how to add capabilities to them, see Users and roles for Splunk Enterprise Security.

Enriching data

Enriching data involves using assets, identities, and threat intelligence.

Threat intelligence (TI) is an important source of data enrichment that speeds up incident response. TI is information that has been collected, analyzed, and evaluated for reliability by people with deep security expertise. It's packaged for integration with security analytics tools such as ES, and with orchestration tools such as Splunk SOAR.

ES includes a threat intelligence management system that ingests data from external sources, feeds threat detection searches, and enriches investigations with intelligence about the observables they contain. You can store threat intelligence in two ways:

  • Native threat intelligence: Stored in KV store collections in ES. You configure threat intelligence sources and turn on threat-matching searches.
  • Threat Intelligence Management (Cloud): You configure threat intelligence sources and threat lists, and can create safelist libraries. Intelligence from Threat Intelligence Management (Cloud) appears on the Intelligence page of an investigation.

In Splunk Cloud Platform deployments, you can also install Cisco Talos Intelligence for Enterprise Security to enrich findings with Talos reputation and threat classification data for URLs, IP addresses, and domains.

Explore additional content that helps you better understand enriching data in ES:

Configuring detections

A detection is a scheduled search that scans multiple data sources for patterns that might indicate anomalies or threats. When a detection finds a match, it can create a finding, adjust a risk score, or run an adaptive response action. Analysts triage findings in the analyst queue on the Mission Control page, which shows the urgency of each finding and other context so you can decide on next steps quickly.

ES has two types of detections:

  • Event-based detections: Review raw events and create findings, which appear in the analyst queue, or intermediate findings, which don't appear in the analyst queue but can feed other detections.
  • Finding-based detections: Review findings and intermediate findings, and group those that affect the same entity, or that match other criteria, into finding groups when a pattern is identified or a risk threshold is crossed.

Detections are often synonymous with use cases. Security-focused use cases often involve searching for an indicator of compromise and, when one is found, raising it for investigation or remediation. You should automate many of the repetitive tasks involved in investigation and remediation with a SOAR product such as Splunk SOAR.

To configure detections:

  1. In ES, select Security content > Content management.
  2. Filter the content by type Detection.
  3. Turn detections on or off, update the settings that control how they run, change the search logic in the detection editor, and throttle their adaptive response actions. This page is where much of your tuning and development takes place.

Determining what to search, filter, or adjust can be complex. If you need direct help, use OnDemand Services early and often to access experts available on request. You can also access a catalog of some of the services available to you.

It's best to turn on one detection at a time, understand how that detection works, and validate that it provides valuable information, not just noise. Turning on too many detections at once risks flooding your SOC with findings, which can be hard to fix. Start small, because the speed of turning on, validating, and tuning detections increases with practice. No SIEM is a set-and-forget endeavor. It requires a practice of continuous improvement because the nature of security is itself dynamic.

ES is highly flexible in its ability to be improved and to pivot in different directions as an investigation or hunt unfolds. This flexibility makes your learning curve steeper, but after you have a working knowledge of ES, your ability to detect, respond to, and act on security incidents is robust and fast.

Configuring detections is a big topic. If you'd like to go deeper, here is some more useful content to read:

Using risk-based alerting

You can use risk-based alerting (RBA) in ES to implement use cases more efficiently. In ES, finding-based detections apply RBA by grouping the findings and intermediate findings associated with an entity, so analysts see a single finding group when an entity's combined risk crosses a threshold instead of triaging every individual alert. To get started with RBA, see the following resources:

Using the behavioral analytics service in Enterprise Security Premier

If you use Splunk Enterprise Security Premier in Splunk Cloud Platform, you can turn on the behavioral analytics service to add threat detections that monitor cyber threats and enhance your security operations. The behavioral analytics service ingests raw data from various supported source types and provisions tenants automatically. You can also forward findings, risk events, and asset and identity data from ES to the service.

The behavioral analytics service is available only for Splunk Cloud Platform stacks in the US East (Virginia) AWS region, for non-FedRAMP customers with a data ingestion volume of less than 4 TB. It isn't available for on-premises deployments. To turn on the service, in ES, select Configure > General settings, then scroll to the Behavioral analytics service panel. After the service is turned on, you can manage its detections in Security content > Content management.

To learn more, see Turn on behavioral analytics service on Splunk Enterprise Security.

Triaging and investigating on the Mission Control page

The Mission Control page is where analysts triage, investigate, and respond to security incidents in ES. To open it, select Mission Control from the main navigation bar. On the Mission Control page, you can do the following:

  • Review findings, finding groups, and investigations in the analyst queue, and filter and save views to focus on what matters most to you.
  • Start investigations from findings, and add events, notes, and files to keep other analysts informed.
  • Apply response plans, such as NIST 800-61, to follow standardized tasks and phases for each type of investigation.
  • Use threat intelligence to assess the risk posed by the observables in an investigation.

With Splunk Enterprise Security Premier, you can also run Splunk SOAR actions and playbooks from an investigation to gather more information and remediate security incidents.

Previous step

Next step