Splunk App for Enterprise Security
A single solution to detect known threats and look for unknown threats through analysis of massive volumes of activity data. Splunk App for Enterprise Security is a scalable security intelligence platform with the flexibility to make tens of terabytes of data per day security relevant through comprehensive analysis capabilities that breaks down organizational data silos and data collection issues. * Situational awareness dashboards give custom views of risk per domain, asset, or identity * Incident Review provide analysis workflows that reveal the priority of the incident, incident context, and impact on assets and identities * Analysis centers provide indicators of unknown threats from traffic abnormalities * Correlation tools enable monitoring for new attackers by correlating new domain registration with web activity * Statistical outlier detection tools aid anomaly detection * Unified Threat Intelligence from many sources * Data inputs provided for NetFlow, logs, RDBMS, APIs, & more
Hurricane Labs App for Shodan
This app allows you to enter your external subnets and get an idea of what the Internet sees when it looks at your network (okay what bad guys can see) externally. It utilized the Shodan (www.shodanhq.com) so you will need an API key and you will also need our SA-shodan add-on. Install SA-shodan Install App Restart Splunk Enter Subnets in config screen Either run the saved search manually or wait for it to run on schedule (every 12 hours by default) Enjoy!
Splunk for Cisco Firewalls
This add-on has been DEPRECATED. A new add-on has been released for Cisco firewalls and can be downloaded here -> http://apps.splunk.com/app/1620/ This add-on only collects and extracts data. The add-on does not include visualizations. The Cisco Security Suite contains visualizations for Cisco Firewalls as well as other Cisco security related products. The Cisco Security Suite can be downloaded here -> http://apps.splunk.com/app/525/ ================================================= The Splunk for Cisco Firewalls technology add-on is a collection of inputs, field extractions, and other search-time knowledge that is used to drive reporting and search for data collected from Cisco firewall devices - FWSM, Pix, ASA.