Managing security content in Splunk Enterprise Security

As a Splunk Enterprise Security administrator, you can use the Content Management page to display, create, configure, and edit content that is unique to Splunk Enterprise Security, such as detections, key indicators, saved searches, and swim lane searches.

• Create event-based detections in Splunk Enterprise Security
• Create finding-based detections in Splunk Enterprise Security
• Create and manage key indicator searches in Splunk Enterprise Security
• Create and manage saved searches in Splunk Enterprise Security
• Create and manage search-driven lookups in Splunk Enterprise Security