Exploring security content with Splunk Enterprise Security

To efficiently manage the ESCU content, use the app within Splunk Enterprise Security because ESCU integrates seamlessly with the frameworks provided by Splunk Enterprise Security.

The following docs assume that ESCU is used within Splunk Enterprise Security.

Update ESCU from Splunk Enterprise Security

When a new security content update is available on Splunkbase, Splunk Enterprise Security (ES) prompts you to update the app. Regular updates ensure that your application remains up to date with the newest features and security measures.

Follow these steps to update the ESCU app and download the latest security content within Splunk Enterprise Security:

1. Select Update app when prompted in Splunk Enterprise Security.
2. Check the box and select Accept and continue.
3. Enter your Splunkbase credentials and select Login and Continue.

Alternatively, you can also install the ESCU app as you install other Splunkbase applications. You can login into Splunkbase.com with your Splunk credentials, download the latest version of the app, and install the app on the Splunk Platform search heads.