Library SOC bookmarked a high-value hunt in Splunk Security Essenti…

Question

Library SOC bookmarked a high-value hunt in Splunk Security Essentials and wants it to become an ES detection. What should the analyst know about that path?

Accepted Answer

SSE success-path and bookmark content can be exported as a starting point for an ES correlation search; an engineer still implements the production detection. — SSE bookmarks are seeds, not a magic Enable button. The library analyst should know the content can be exported as a correlation-search starting point, and that an engineer still lands it in ES. Python playbooks and CIM rebuilds are the wrong path.

Answer

Bookmarking in SSE automatically authors and enables the ES correlation search with no engineer.

Answer

SSE content cannot enter ES; the only path is writing Python in SOAR.

Answer

Promotion requires rebuilding the CIM from the ES admin install lab.

Library SOC bookmarked a high-value hunt in Splunk Security Essentials and wants it to become an ES detection. What should the analyst know about that path?

Short Explanation

Full Explanation