Applied Network Security

Splunk

Splunk enterprise is a SIEM software developed by the Splunk cooperation. Splunk has two different versions; Splunk enterprise is a locally installed software, and the other is the Splunk cloud service which is nearly identical to the enterprise version, just cloud-based. Splunk gathers data from a number of different sources including security controls, operation system, and applications. It uses this data and performs analysis to identity activity or operation that violates your security policies or is deemed suspicious. Once Splunk identifies suspicious or unwanted activity, it can send an alert to the operator or try and stop the attack itself before the attack is completed, depending on how it is configured.

Splunk enterprise ...