Splunk for Security: SSE - Essential Security

This video explores the essential security dashboarding features in Splunk Security Essentials, providing an overview of how to enable and utilise these built-in dashboards. While these dashboards are not activated upon installation, the video walks through the setup process, starting with navigating to the "Create Posture Dashboards" section. Here, users can execute essential security searches to assess data availability in their environment—a necessary step before enabling dashboards. Once the searches are complete, users can select and activate dashboards tailored to specific categories, including account security, host security, and network security.

The video highlights the customisability of these dashboards, allowing users to choose relevant panels based on their data sources. Once created, these dashboards provide valuable insights, such as identifying top users or sources with failed authentication attempts and monitoring patterns in persistent failures. Accessible via the "Security Operations" menu, these dashboards are designed to enhance visibility into security activities and streamline incident monitoring.