Splunk App for Enterprise Security
A single solution to detect known threats and look for unknown threats through analysis of massive volumes of activity data. Splunk App for Enterprise Security is a scalable security intelligence platform with the flexibility to make tens of terabytes of data per day security relevant through comprehensive analysis capabilities that breaks down organizational data silos and data collection issues. * Situational awareness dashboards give custom views of risk per domain, asset, or identity * Incident Review provide analysis workflows that reveal the priority of the incident, incident context, and impact on assets and identities * Analysis centers provide indicators of unknown threats from traffic abnormalities * Correlation tools enable monitoring for new attackers by correlating new domain registration with web activity * Statistical outlier detection tools aid anomaly detection * Unified Threat Intelligence from many sources * Data inputs provided for NetFlow, logs, RDBMS, APIs, & more
Splunk Add-on for Nessus
The Splunk Add-on for Nessus allows a Splunk administrator to index Nessus vulnerability scan reports. This add-on provides the inputs and CIM-compatible knowledge to use Nessus data with other Splunk apps, such as Splunk App for Enterprise Security and Splunk App for PCI Compliance.
Sideview Utils (LGPL)
Sideview Utils provides new and easier-to-use modules for the Splunk UI. You can mix and match these new modules with the core UI modules that ship with Splunk. As you start using the new modules in your Splunk views, your views will become much simpler to create and maintain (and even a little more powerful). Over time as you upgrade to the new modules and new techniques, you'll find that many of the parts of the Splunk UI that were the hardest to use are simply gone,