About Splunk Enterprise Security

Splunk Enterprise Security uses the Splunk platform's searching and reporting capabilities to provide the security practitioner with an overall view of their organization's security posture. Enterprise Security uses correlation searches to provide visibility into security-relevant threats and generate notable events for tracking identified threats. You can capture, monitor, and report on data from devices, systems, and applications across your environment.

If you purchase Splunk Enterprise Security, you can download the app from Splunkbase. Additionally, Splunk does not monitor data ingestion based on your license, irrespective of whether you are using the on-prem or the Cloud version. For example, if you purchase a 1 GB license for Splunk Enterprise and purchase another 1 GB for Splunk Enterprise Security app, you can ingest 2 GB of data, irrespective of the data set. Thus, you can monitor your own data ingestion and usage.

This manual is written for a user capable of installing, configuring, and administering Splunk software. If you need training on the Splunk platform and Enterprise Security, see Education Courses for Enterprise Security Customers.

Other manuals for Splunk Enterprise Security:

• Release Notes
• Use Splunk Enterprise Security
• Administer Splunk Enterprise Security
• Use Cases
• REST API Reference