What is Splunk Enterprise Security Content Update?

Splunk Enterprise Security Content Update (ESCU) is a free, lightweight Splunk application that is developed, updated, and maintained by the Splunk Threat Research team (STRT). ESCU delivers security use case guides called analytic stories, which contain a collection of detection analytics that help to address specific use cases for a wide variety of platforms such as Windows, Linux, and various Cloud environments. ESCU provides security teams with high quality and tested searches that are designed to detect the tools, tactics, and procedures used by adversaries to compromise an organization.