Splunk® Enterprise Security

Use Splunk Enterprise Security

Acrobat logo Download manual as PDF


Splunk Enterprise Security (ES) versions 6.0.0, 6.0.1, and 6.3.0 are no longer available for download from Splunkbase as of April 15, 2021. Please upgrade to the latest version of Splunk Enterprise Security to avoid any potential issues with Assets and Identity management.
This documentation does not apply to the most recent version of Splunk® Enterprise Security. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Investigations in

Visualize and document the steps you take during an investigation by creating and adding details to an investigation in .

You can start, manage, and add details to investigations on the Investigations page. View or filter the investigations assigned to you, or create one. You can view all investigations that you collaborate on using the Investigations page. Enterprise Security admins can also view and manage all investigations that exist in Splunk Enterprise Security. For information for admins, see Manage investigations in Splunk Enterprise Security in Administer Splunk Enterprise Security.

As an analyst, you only see investigations assigned to you unless you also have been granted the capability to manage all investigations.

Manage your investigations

Manage ongoing investigations from the Investigations page. You can see the titles, descriptions, time created, last modified time, and collaborators on the investigations assigned to you. If you have the capability to manage all investigations, you can see all the same details for all investigations, not just the investigations that you collaborate on.

Find an investigation or refine the list of investigations by filtering. Type in the Filter box to search the title and description fields of investigations.

Example investigation workflow

  1. You are notified of a security incident that needs investigation through a notable event, an alert action, or an email, ticket from the help desk, or a phone call.
  2. Create an investigation in .
  3. Add colleagues to the investigation as collaborators.
  4. Open the investigation and start investigating on the workbench.
  5. Add artifacts to the investigation scope, in addition to those added automatically from notable events.
  6. Review the tabs and panels for information relevant to your investigation, such as additional affected assets or details about the affected assets that can accelerate your investigation.
  7. As you investigate, add helpful or insightful events, actions, and artifacts to the investigation to record the steps you took in your investigation.
    1. Run searches, adding useful searches to the investigation from your action history with the investigation bar or relevant events using event actions. This makes it easy to replicate your work for future, similar investigations, and to make a comprehensive record of your investigation process.
    2. Filter dashboards to focus on specific elements, like narrowing down a swim lane search to focus on a specific asset or identity on the asset or identity investigator dashboards. Add insightful filtering actions from your action history to the investigation using the investigation bar.
    3. Triage and investigate potentially-related notable events. Add relevant notable events to the investigation.
    4. Add notes to record other investigation steps, such as notes from a phone call, email or chat conversations, links to press coverage or social media posts. Upload files like screenshots or forensic investigation files.
  8. Complete the investigation and close the investigation and optionally, close associated notable events.
  9. Review the investigation summary and share it with others as needed.
Last modified on 22 November, 2021
PREVIOUS
How urgency is assigned to notable events in Splunk Enterprise Security
  NEXT
Start an investigation in Splunk Enterprise Security

This documentation applies to the following versions of Splunk® Enterprise Security: 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.3.0 Cloud only, 6.4.0, 6.4.1, 6.5.0 Cloud only, 6.5.1 Cloud only, 6.6.0, 6.6.2


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters