During this webinar, we demonstrated how you can overcome common challenges that customers struggle with when operationalizing Splunk Enterprise Security and Risk Based Alerting. Whether you are a new ES customer, or you’ve had ES for years, this webinar showed you how to quickly unlock the powerful features contained in Splunk ES.
We presented a demo of Outpost Security's Splunk App - Zero-to-One. This is a premium Splunk App available through Carahsoft that is designed to accelerate the deployment of RBA in Splunk ES. Using the app, you are able to demonstrate end-to-end RBA functionality in your environment in less than two weeks. The result is automatically enriched RBA notables for your analysts to review and respond to. Zero-to-One includes built-in best practices Outpost Security has developed by deploying RBA to over one million endpoints.
Attendees joined us to cover:
- The foundational elements of ES – data models, assets and identities, and threat intelligence feeds
- How we rapidly configure these elements and enable Risk Based Alerting
- How to release RBA detections to your SOC and work with them to quickly tune them for accuracy