Skip to main content
Lantern Home

 

Splunk Lantern

Using Enterprise Security for security investigation and monitoring

  1. Last updated
  2. Save as PDF

With your detections turned on, Splunk Enterprise Security (ES) generates findings that your analysts can triage, investigate, and respond to. This step shows you where to monitor your security posture, how to work findings and investigations on the Mission Control page, and which dashboards help you accelerate investigations.

Identifying and investigating security incidents

Monitoring security status with the Security posture dashboard

The Security posture dashboard gives you high-level insight into the findings across all security domains in your deployment, and is suitable for display in a SOC. Use it to:

  • View the count of findings by security domain over the last 24 hours.
  • Review findings by urgency and over time, and identify the top findings and top finding sources.
  • Drill down from any panel to the analyst queue on the Mission Control page, filtered to the findings you selected.

To measure how your SOC is performing, use the SOC operations dashboard, which shows key metrics such as mean time to triage, mean time to resolution, investigations created, and dispositions over time.

Triaging findings and investigations on the Mission Control page

To open the analyst queue, select Mission Control. The analyst queue lists the findings, finding groups, and investigations in your environment. From the analyst queue, you can:

You can also use the AI Assistant to summarize findings and investigations, suggest SPL for further investigation, and generate finding or investigation reports. In Splunk Enterprise Security Premier, AI-powered agents can also analyze findings and recommend a disposition.

For a full walkthrough of the analyst workflow, see Overview of Mission Control in Splunk Enterprise Security.

Accelerating your investigations with security intelligence

To open the security intelligence dashboards, in ES, select Analytics > Security intelligence.

  • Use the Risk analysis dashboard to review recent changes to risk scores and the entities with the highest risk scores, determine the source of a risk increase, and decide whether additional action is needed. You can also review risk modifiers by MITRE ATT&CK annotation and by threat object.
  • Use the Protocol intelligence dashboards to get network insights that are relevant to your security investigations. Identify suspicious traffic, DNS activity, and email activity, and review the connections and protocols in use in your network traffic.
  • Use the Threat intelligence dashboards to add context to your investigations and identify known malicious actors in your environment, using the threat intelligence sources included in ES and custom sources that you configure.
  • Use the Asset and identity investigator dashboards and the User activity dashboard to investigate and monitor the activity of users and assets in your environment.
  • Use the Web intelligence dashboards to analyze web traffic in your network and identify notable HTTP categories, user agents, new domains, and long URLs.

Monitoring security domain activity

Use the security domain dashboards to monitor the events and status of important security domains, and the search dashboards for each domain to investigate raw events:

  • Access domain dashboards display authentication and access-related data, such as login attempts, access control events, and default account activity.
  • Endpoint domain dashboards display endpoint data relating to malware infections, patch history, system configurations, and time synchronization information.
  • Network domain dashboards display network traffic data provided by devices such as firewalls, routers, network intrusion detection systems, network vulnerability scanners, proxy servers, and hosts.
  • Identity domain dashboards display data from your asset and identity lists, as well as the types of sessions in use.

For the full list, see Available dashboards in Splunk Enterprise Security.