Enterprise security engineering tasks

[vikram1583]

Hi in my company they recently migrated to Spunk(Enterprise Security) from QRador so installation part is done rule creation is done
and Vulnerability center , asset data feed,user data feed,tuning correlation searches,
work flow, run books done, so now they are moving to Engineering on demand work so they asked me to prepare engineering tasks for next few months so i don't have idea what tasks will be i never worked on ES
Can some one help me please.

[smoir_splunk · Accepted solution]

If you've installed the product, set up correlation searches and asset and identity correlation, plus tuned the searches and confirmed that Vulnerability Center is working, I'd say that the next steps are for the SOC analysts and security teams to actually use the product, and then get engineering-on-demand tasks from those teams.

Are there integrations with tools that those teams use that aren't set up? Are there additional data sources that they might want later? Or some adaptive response or workflow actions that they might want set up so that they can more easily respond to and remediate issues? Those are some tasks that might come up later, but you'll have to work with the security teams to understand their use cases and what they cannot do with ES now that it's set up that might require extending it. You can find documentation about how to write new adaptive response actions on dev.splunk.com: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBF