Splunk
by Cisco
Security information and event management (SIEM) platform for log analysis and monitoring
Authoritative Sources
Key guidance documents from authoritative organizations. Click to view the original source.
NIST SP 800-92 Executive Summary: "Log management is essential to ensuring that computer security records are stored in sufficient detail for an appropriate period of time. Routine log analysis is beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems." §2.2: "Routine log reviews and analysis are beneficial for identifying security incidents, policy violations, fraudulent activity, and operational problems shortly after they have occurred." §3.4: "Security information and event management (SIEM) software is a type of centralized logging software that can perform log collection, log analysis, log aggregation and event correlation, log data storage, event monitoring, and reporting capabilities." §4.2: "Organizations should require logging and analyzing the data that is of greatest importance."
Configuration Examples(3)
CIS Control 8 requires centralized log collection, standardized time sources, and log retention. Splunk provides enterprise log management capabilities.
Configuration Examples(1)
Use case library with pre-built security detections mapped to MITRE ATT&CK. Covers threat hunting, compliance monitoring, and incident response.
Configuration Examples(4)
NIST SP 800-61r2 §3.2.4: "Organizations should profile networks and systems to measure the characteristics of expected activity so that changes to it can be more easily identified." §3.2.5: "Log correlation is important because a single log entry may not contain enough information to draw a conclusion about the nature of the incident." §3.4.2: "Evidence should be collected according to procedures that meet all applicable laws and regulations."
Configuration Examples(2)
Verification Commands
Commands and queries for testing and verifying security configurations.
index=main sourcetype=*auth* (failed OR failure OR denied) | stats count by user, src_ipindex=main sourcetype=*auth* action=failure | stats count by src_ip | where count > 10index=main (sourcetype=WinEventLog:Security EventCode=4672) OR (sourcetype=linux_audit type=USER_AUTH) | stats count by user| tstats count WHERE index=* by index, sourcetype | sort -count| rest /services/saved/searches | table title, cron_schedule, is_scheduled, alert_typeRelated Controls
Security controls from various frameworks that relate to Splunk.