Posts

Enhancing Security Operations: The Native Integration of Splunk ES and SOAR

/in , , , /by

Integrating Splunk Enterprise Security (ES) with Splunk Security Orchestration, Automation and Response (SOAR) can significantly enhance your organization’s security operations. By automating alert handling and response processes, this integration streamlines security incident management and enables faster, more effective threat mitigation. Splunk SOAR empowers security teams to automate actions based on Splunk ES detections using assigned playbooks, enabling seamless incident resolution.

Read more

Upgrader App for Splunk: Effortlessly Upgrade Your Splunk Instance

/in , , /by

Upgrading on-premise Linux Splunk Enterprise instances has historically been a complex and challenging task, but the new Upgrader App for Splunk (UA4S) app is designed to change that. In this review, we’ll take a closer look at how this app simplifies the upgrade process and makes this task accessible for anyone, even those without extensive technical expertise.

Read more

Asset Investigations with Splunk Asset and Risk Intelligence

/in , , , /by

Splunk Asset and Risk Intelligence (ARI) enables your team to quickly perform complete and thorough asset investigations. An interactive and holistic approach provides security teams with much needed context about assets, including asset health, network activity and associations.

Read more

Setting Up a Splunk Testing Environment Using Terraform & GCP

/in , , , /by

Overview

Have you ever wished you had a fresh ephemeral Splunk instance that you could quickly spin up, run some tests and then kill it, with maximum speed and minimum cloud costs?

Enter Hashi Terraform to the rescue. The industry-leading infrastructure-as-code tool makes the standup, setup and teardown of cloud compute nodes simple, speedy and repeatable so that an environment can be built, a complete set of tests can be run, results received and the test nodes destroyed in minutes rather than hours.

In this whitepaper, I show how I set up my computer and built the Search Head and Deployment server, as well as how I set up the many Splunk Universal Forwarders to satisfy the test plan.

Download Whitepaper

Get access to this exciting whitepaper now, by completing the form below.

Looking to expedite your success with Terraform? Click here for more information about our Terraform Professional Service offerings, including:

  • Terraform Implementation
  • Infrastructure Migration using Terraform
  • Implementing Zero Trust Architectures
  • Terraform Operational Assessment

Asset Risk with Splunk Asset and Risk Intelligence

/in , , , /by

Splunk Asset and Risk Intelligence (ARI) provides teams with detailed and powerful visibility into risks affecting discovered assets. This helps teams to quickly identify and address gaps in security controls, understand compliance with cybersecurity frameworks and offers greater context during security investigations.

Read more

Asset Activity with Splunk Asset and Risk Intelligence

/in , , , /by

Splunk Asset and Risk Intelligence (ARI) provides detailed insights into how active an asset has been over time. Instantly identify who had what asset and when, view any asset changes or even identify unusual asset activity within your network.

Read more

Asset Discovery with Splunk Asset and Risk Intelligence

/in , , , /by

Splunk Asset and Risk Intelligence (ARI) continuously discovers all assets on the network using a unique approach that creates a single source of truth from multiple sources of record, resulting in comprehensive and accurate asset visibility and reporting.

Read more
Splunk asset and risk intelligence

Introducing Splunk Asset and Risk Intelligence

/in , , , /by

What is Splunk Asset and Risk Intelligence?

Splunk Asset and Risk Intelligence (ARI) is a powerful, premium application from Splunk which delivers proactive risk mitigation through continuous asset discovery and compliance monitoring.

Read more
Splunk asset and risk intelligence

Splunk Asset and Risk Intelligence – a CAASM Solution for Splunk

/in , , , , /by

Image credit: https://www.splunk.com/en_us/products/asset-and-risk-intelligence.html

At the recent Splunk .Conf in Las Vegas a couple of weeks ago, we were able to get a detailed demo of Splunk’s new and exciting Splunk Asset and Risk Intelligence (Splunk ARI) security solution. What a great solution and one that is much needed within their security solution portfolio. Splunk ARI falls into a category of products known as CAASM – Cyber Asset Attack Surface Management. In this post, we dive a little deeper into what CAASM is, why it is critical tool for your organization and how Splunk ARI can help.

Read more

4 Enhancements to Elevate Your Splunk Platform

/in , , , /by

Still winding down from the incredible experience at .conf24, where we delved into the latest market trends, we’ve uncovered several fascinating enhancements for the Splunk platform. These improvements not only elevate the performance and efficiency of Splunk but also offer exciting features that will be available in future releases. Join us as we explore four powerful upgrades that can be used in your Splunk environment.

Read more