Overview of Splunk Security Essentials

Splunk Security Essentials is a free Splunk app that helps you find security procedures that fit your environment, learn how they work, deploy them, and measure your success. Splunk Security Essentials has over 120 correlation searches and is mapped to the Kill Chain and MITRE ATT&CK framework. Within the app, there are detections with line-by-line SPL documentation that show why certain search commands are used and include context such as the security impact, implementation, and response. The app also includes content from Splunk Enterprise Security, Splunk Enterprise Security Content Update, and Splunk User Behavior Analytics.

To get started with Splunk Security Essentials, perform the following tasks:

• Install Splunk Security Essentials from a single-instance or distributed deployment. See Install Splunk Security Essentials.
• Configure Splunk Security Essentials by mapping data sources, running content mapping, and use the Data Source Check dashboard to verify if data sources exist for examples. See Configure Splunk Security Essentials.