An application for Splunk Enterprise Security providing additional insights into everything surrounding and/or impacting your security detections.

See the application documentation here for more information on installing, configuring and using it.

Credit goes to the awesome Gerry D'Costa for the Search Concurrency diagram.
Thanks to Dean Luxton for reporting issues, fixes and improvement ideas!

Nov. 25, 2024

Detection Insights - Release Notes

See details here.

Feb. 13, 2024

Rework initial setup dialog to run prerequisite lookup generating searches automatically
Add a check to look for the absence of summariesonly for tstats detections
Add a filter for issues to the Detection Details Tab
Add a filter for issues to the Scheduling Details Tab
Add a new Tab for Data Models
Add a new check to ensure RFC1918 addresses specified are correct
Add a table of checks to the documentation
Add an overview check for Default Notable values set
Add check for CIM fields being used directly - e.g. src_ip
Add check for detection using SPL commands that have known limits/performance limitations
Add detection check for RBA Risk rules that do not have a Risk Object configured
Add detection check for RBA Risk rules that do not have a Threat Object configured
Add detection check for detections missing Next Steps
Add new check for detections without a drilldown search
Add new overview check for detections using indexed time
Add panel and/or check around false positive

Dec. 12, 2023

Add a Quick Tour to help first time users get familiar with the application
Add drilldowns from the MITRE Heatmap Viz
Add panels to the RBA Details tab to allow user to see detections using particular ROs/TOs
Make changes to comply with the Splunk Splunkworks guidelines
Add button to manually update saved searches metadata
Add macro for Provided by code quality
Change check CHKDET0014 to disabled by default and improve Name
Add an overview check for Detections without a Security Domain
Add pre-requisites tab
Update contrib lookups (ART, SigmaHQ, etc.)
Other minor fixes
Change License to SGT

Oct. 10, 2023

Oct. 10, 2023

1,315

Downloads

Share Subscribe

Splunk Works

Christian Cloutier

Not Supported

Questions on Splunk Answers Flag as inappropriate

This version of the app (1.0.6) is not available for Splunk Cloud. However, version 1.1.0 of this app is available for Splunk Cloud.

Products: Splunk Enterprise, Splunk Cloud

Products: Splunk Enterprise

Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2