THIS APP SUPPORT SPLUNK ENTERPRISE 8.2 and SPLUNK CLOUD 8.1 and above.
The Modern SOC Management App for Splunk is a modernized application developed using Splunk Studio that provides rapid insight and operational visibility to the SOC analyst and leads to hunting and identifying interesting events on day-to-day operations. This app contains several dashboards that will help the analyst to perform his analysis and investigation.
The Application contains of two dashboard built using Splunk Studio
SOC Management: This dashboard provide insight about the overall event log volumn, authentication status, network connections, process creation and powershell command executions.
User Management: This dashboard allows the analyst to perform quick investigation and lookup on user authentication and for any suspicious indicators.
Note: This application requires logs from Sysmon, Powershell and windows security logs to function perfectly.
This App can expand and possibility to create more dashboards to cover network management, application management, malware management that developed under UX / UI focus. Feel free to reach me if you have any recommendations
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.