FalconSearch
Overview
Details
FalconSearch: Enhancing Enterprise Security with Speed and Efficiency
Overview
FalconSearch is a Splunk app designed to revolutionize your approach to Enterprise Security. By leveraging advanced base searching techniques, FalconSearch optimizes search times and resource usage, delivering lightning-fast results with reduced overhead. This app integrates seamlessly with your existing Splunk environment, enhancing your cybersecurity operations without sacrificing performance.
Required Apps
Before using FalconSearch, make sure you have the following apps installed:
-
Splunk Enterprise Security: A comprehensive solution for security information and event management (SIEM).
-
Splunk Common Information Model (CIM): A standardized framework for normalizing data for analysis and reporting.
-
Splunk Machine Learning Toolkit: Provides ML and AI to allow detections of outliers.
-
Splunk Enterprise Security Content Update (DA-ESS-ContentUpdate): A content update for Splunk Enterprise Security.
Ensure that these apps are properly installed and configured before setting up FalconSearch.
Key Features
-
Efficient Search: FalconSearch harnesses the power of base searching, enabling quicker data retrieval while conserving valuable resources.
-
Speed and Precision: Experience accelerated search times without compromising the meticulous analysis required for effective cybersecurity.
-
Intelligent Correlation: The app employs intelligent correlation techniques, maximizing the value of your search results.
Usage
-
Access the FalconSearch app from the Splunk Home screen.
-
To properly set up the app:
a. Modify the search macros to restrict indexes on the basesearches (by default they are set to index=*).
b. Enable the base searches for the content you wish to enable.
c. There are 33 base searches that drive all content within the app
To enable the base searches:-
Go to Settings -> Searches, Reports, and Alerts.
-
Filter on App: FalconSearch and Owner: Nobody.
-
-
Run the
| fsinstallcommand from search (This may take a momenent but you will be presented with output of status for each subapp installation. Additional logging is also available viaindex=_internal source="/opt/splunk/var/log/splunk/falconsearch.log") -
Once the base searches are enabled, you can start enabling content within Enterprise Security.
-
Manage correlation searches via Configure -> Content -> Content Management. Locate the appropriate FalconSearch app and enable/disable content for correlation searches.