How to use Splunk Security Content

From the Splunk Security Content menu bar, you can navigate to the following pages:

• Content Library to view the dashboard of Analytic Stories and search summaries
• Feedback Center to send feedback directly to the Splunk Security Research Team
• Usage Details to see what your users are doing inside your instance of ESCU

If you use Splunk Enterprise Security or Splunk Security Essentials, you can access Analytic Stories through those apps.

• See Manage Analytic Stories through the use case library in Splunk Enterprise Security in the Splunk Enterprise Security Administer Splunk Enterprise Security manual to enable correlation searches.
• See About Splunk Security Essentials in the Splunk Security Essentials Use Splunk Security Essentials manual.

Content Library

Access the Analytic Stories Stats tab to explore the Analytic Stories included with Splunk Security Updates using the Category, CIS Critical Security Control, or Kill Chain Phase mapping.

Access the Search Summary tab to see the searches associated with an Analytic Story and explore them based on their CIS Critical Security Control mapping or by search type.

Analytic Story Detail

The Analytic Story Detail view provides information on how to use Splunk ES to address a particular threat.

Splunk Security Content categorizes the stories according to the table below.

Category	Analytic Stories
Malware	Brand Monitoring Data Protection Host Redirection Lateral Movement Malicious PowerShell Ransomware SQL Injection Suspicious DNS Traffic Suspicious Emails Suspicious WMI Use Unusual Processes Windows Log Manipulation Windows Persistence Techniques
Known vulnerabilities	Apache Struts Vulnerability DNS Amplification Attacks JBOSS Vulnerability Monitor for Updates Splunk Enterprise Vulnerability
Best practices	Account Monitoring and Controls Asset Tracking Router & Infrastructure Security Monitor Backup Solution Monitor for Unauthorized Software Use of Cleartext Protocols Prohibited Traffic Allowed or Protocol Mismatch

Analytic Stories provide you with tactics, techniques, and methodologies to assist with detection, investigation, and response. They include easy-to-read background information, key context for motivations and risks associated with the attack techniques in question, and pragmatic advice on how to combat those techniques.

Each story is mapped to various frameworks, including MITRE ATT&CK, Lockheed Martin Kill Chain phases, CIS controls, and NIST, and include the following content objects:

1. Detection: OOTB detection techniques in the form of detection searches or machine-learning models
2. Investigation: Searches and/or Splunk Phantom playbooks that help the analyst determine whether a notable event is true-positive. For example, the analyst may wish to review additional notables related to the participating entity (additional detections). They may also need to gather collaborative evidence and additional contextual information.
3. Response: These help the analyst conduct specific response actions to remediate the incident.

Analytic Stories are categorized by use case and can be accessed via the Splunk ES Use Case Library or Splunk Security Content.

Select any search to view its search name, description, kill chain phase, and details.

Customize to your Environment

Release 1.0.46 introduced input(pre-filter) and output(post-filter) macros for each of our detection searches. These macros let you update a macro definition once and then apply the new definition across all detections that leverage that macro. These changes will be local to your Splunk environment.

• input(pre-filter): This macro specifies your environment-specific configurations (index, source, sourcetype, etc.) to get the specific data sources that you require. Replace the macro definition with configurations for your Splunk environment.

• output(post-filter): This macro specifies your environment-specific values (dest, user, etc,), to filter out known false positives. Replace the macro definition with values that you'd like to exclude from detection results.

Coming soon is an improved naming convention that will be consistent across all of our detections, investigations, and baselines.

Feedback Center

Access the Feedback Center to send feedback directly to the Splunk Security Research Team. Contact us at research@splunk.com to send us support requests, bug reports, or questions directly to the Splunk Security Research Team. Please specify your request type and/or the title of any related Analytic Stories.

Usage Details

Access Usage Details to see how your team is using Splunk Security Content. You can access details such as the following:

• The searches your team runs most frequently
• The types of searches your team runs, including the names of the searches and the average and total run times