Skip to main content
Lantern Home

 

Splunk Lantern

Getting started with Splunk Enterprise Security

  1. Last updated
  2. Save as PDF

This guide is designed to help you make the most of your investment in Splunk Enterprise Security (ES) and to make improvements on your configuration to ensure you receive maximum value.

It's important that you understand how ES can provide visibility of your organization's security posture. ES uses detections to search your data for security-relevant threats and generate findings that your analysts triage and investigate on the Mission Control page. You can capture, monitor, and report on data from devices, systems, and applications across your environment.

ES is available in two editions. ES Essentials includes threat detection, investigation, risk-based alerting, and threat intelligence management. ES Premier adds Splunk SOAR automation and user and entity behavior analytics (UEBA). To compare them, see Overview of Splunk Enterprise Security Editions.

If you're upgrading from ES 7.x, follow the Upgrading to Enterprise Security 8.x learning path first.

Installing Enterprise Security

ES is highly configurable. Because of this, we recommend that Professional Services handle your installation and initial configuration. While installation is automated for Splunk Cloud Platform customers, a Professional Services engagement is still recommended to help with configuration, including getting data onboarded.

After installing ES, follow these steps:

  1. Identify applicable use cases for security monitoring.
  2. Identify the data sources you need to implement your use cases.
    1. For Splunk Enterprise users, identify the appropriate add-ons from Splunkbase. Most add-ons in Splunkbase are compliant with the Common Information Model (CIM). If data is custom, you need to map it manually to the CIM.
    2. For Splunk Cloud Platform users, engage Professional Services to get your add-ons set up.
  3. Start sending your security-related data to the Splunk platform using your add-ons.
  4. Validate your data using the Splunk Common Information Model (CIM) add-on.
  5. Configure your assets and identities to get the full value of ES.
  6. Turn on and tune detections, then set up the analyst queue and dashboards for security investigation and monitoring.