Splunk for Security: SSE - Content Introspective

This video introduces the advanced search assistance features in Splunk Security Essentials, focusing on how they help identify unusual behaviour patterns. The session begins with a demonstration of the "Detect Spikes" feature, which identifies significant increases in activity, such as a surge in file accesses or system errors. By defining searches, grouping data, and applying threshold methods like standard deviation, users can quickly pinpoint outliers, such as a system producing an unexpected number of errors. This functionality empowers organisations to monitor and address anomalies effectively, enhancing their security visibility.

The video also explores the "Detect New Values" feature, which highlights instances where users or systems exhibit previously unseen behaviour. For example, it detects first-time system access or novel processes running on a machine. Peer group analysis is introduced to refine these detections, ensuring common activities, like new team members accessing shared systems, are excluded. Additionally, the use of lookup caches is demonstrated, allowing continuous tracking of user activity over time. This approach ensures efficient detection of genuinely new events without relying on extensive historical data. Stay tuned for more insights into leveraging Splunk Security Essentials for robust security operations.