Learn Splunk Enterprise Security (ES)

Welcome everyone. Today we’re stepping into the control tower of modern security operations: Splunk Enterprise Security, commonly known as Splunk ES.

Think of Splunk ES as a fast-thinking security brain sitting on top of your data universe. It ingests signals from every direction, correlates them at high speed, and helps you spot incidents long before they become headlines.

So, we’re going to explore what makes ES so powerful, how SOC teams actually use it, and what core components you must understand to operate it with confidence.

What Splunk ES Really Is?

At its heart, Splunk ES is a SIEM — but it’s not just a log collector. It is a security analytics platform. It does four big jobs:

1. Normalize data from dozens of sources
2. Detect threats in real time
3. Investigate incidents using correlated information
4. Respond using dashboards, alerts and automation

A normal SIEM aggregates data. Splunk ES interprets it. It turns raw logs into meaningful stories. If raw data is sand, ES turns it into glass.

This intelligence comes from its backbone: CIM (Common Information Model). Everything flows through this standardized structure, allowing ES to compare apples to oranges and still detect the worm inside.

Data Onboarding & CIM Normalization

Before ES can protect anything, it needs clean, normalized data.

a. Data Inputs

You typically onboard:

• Windows security logs
• Linux audit logs
• Cloud events (AWS, Azure, GCP)
• Firewalls
• EDR platforms
• Proxy/URL filtering
• Identity and authentication logs
• Threat intel feeds

Each log source lands in a Sourcetype. ES expects those sourcetypes to map to CIM data models.

b. CIM (Common Information Model)

CIM is the grammar Splunk ES understands.

It includes models like:

• Authentication
• Network Traffic
• Endpoint
• Alerts
• Malware
• Vulnerabilities
• Web
• Change Analysis

For example: Whether sign-in logs come from Okta, Azure AD or Windows — CIM forces all of them to share fields like:

src
dest
user
signature
action

This makes correlation lightning-fast.

c. Why This Matters

Poor CIM mapping = broken correlation searches = blind SOC.

A well-tuned ES environment starts with disciplined onboarding.

The Home Screen: Security Posture Dashboard

When you log in to ES, the first district of the city you land in is the Security Posture Dashboard. It acts like an air-traffic radar.

Here you’ll see:

• Average notable events per hour
• Categories of threats
• Risk scores
• Attack chains forming
• Top assets and identities under fire

Analysts look here to gain a quick heartbeat of the enterprise.

Notable Events & Correlation Searches

This is the power core of ES.

a. Correlation Searches

These are detective rules that run periodically and identify malicious activity. They feed “Notable Events.”

Examples:

• Multiple failed logins followed by a successful one
• Privilege escalation
• Suspicious PowerShell use
• Impossible travel login
• Malware execution followed by outbound connections
• Disabled logging on an endpoint
• High volume data exfiltration

Each correlation search has:

• A search query
• A schedule
• A severity
• The fields it extracts
• The notable event it creates

Advanced teams enrich these searches with threat intel or UEBA behavioral anomalies.

b. Notable Events

These are alerts that appear in ES as single entries but often represent correlated cross-system data.

Each Notable Event includes:

• Description of the issue
• Category (Endpoint, Access, Network, Privilege, etc.)
• Urgency level
• Asset/identity affected
• Timeline
• Links to drill down

c. How Analysts Work Them

SOC analysts triage notable events like detectives sorting clues.

Tier-1 reviews, Tier-2 investigates, Tier-3 hunts or escalates to IR.

Incident Review Dashboard

This dashboard is where analysts live. Consider it the investigative workstation.

Features:

Status Filters

Open, Closed, In Progress, New

Analyst Notes

Add comments, attach evidence, assign owners

Adaptive Response Actions

Trigger actions via SOAR or Splunk’s adaptive response framework:

• Disable user
• Quarantine host
• Block IP
• Send to sandbox
• Notify IR team

Drilldowns

Clicking a notable opens supporting events, timelines, and related identities.

A good workflow here makes the difference between hunting and drowning.

Threat Intelligence

Splunk ES includes a baked-in Threat Intelligence Module.

Feeds include:

• STIX/TAXII
• Enterprise threat intel vendors
• Open-source IoCs
• Internal threat intel from IR teams

ES performs:

• Indicator matching
• Auto-enrichment
• Threat score assignment
• Cross-correlation with current logs

If an internal endpoint reaches out to an IOC-tagged IP, Splunk ES spots it before the coffee gets cold.

Risk-Based Alerting (RBA)

This is one of Splunk ES’s modern superpowers.

The Problem

• Traditional SIEMs generate too many alerts.
• RBA solves this with context-first detection.

How It Works

Every suspicious behaviour adds risk points to a user or asset. Only when risk crosses a threshold does ES fire a notable.

Example:

• User fails logins = +10
• User runs encoded PowerShell = +30
• Same user accesses sensitive share = +40

Threshold = 50 User hits 80 Now ES generates a consolidated alert.

Benefits:

• Reduced alert fatigue
• Higher accuracy
• Better incident stories

Investigation Workbench

This is your detective board.

It visually maps:

• Entities
• Events
• Relationships
• Time sequences
• Related logs

You see a graph showing machines, users, IPs, processes, and indicators of compromise orbiting each other like constellations. Great for IR and threat hunting.

Key Dashboards You Must Know

1) Identity Investigation Dashboard

Shows all activities tied to a user:

• Logons
• Privileged actions
• Lateral movement
• High-risk behaviours

2) Asset Investigation Dashboard

Same idea, but for devices:

• Installed software
• Network connections
• Vulnerabilities
• Notable events

3) Threat Activity Dashboard

Shows threat-intel matches:

• IP/domain/file hash hits

4) UEBA Add-On Dashboards

Behavior analytics:

• Rare process execution
• Unusual login times
• Privilege anomalies

5) Compliance Dashboards

PCI, HIPAA, ISO, SOC2 visibility

Using Splunk ES for Threat Hunting (5 minutes)

Hunting involves manually searching for threats that haven’t triggered alerts.

Typical hunts inside ES:

• New admin accounts created recently
• Rare PowerShell commands
• Suspicious outbound traffic over unusual ports
• MFA bypass attempts
• Beaconing patterns
• DNS anomalies

ES makes these hunts powerful because all data is CIM-normalized and searchable with a unified schema.

Automation & SOAR Integration

Splunk ES integrates natively with Splunk SOAR.

With it, you can:

• Auto-block malicious IPs
• Auto-disable compromised accounts
• Collect forensics automatically
• Run containment playbooks
• Notify teams
• Execute threat enrichment

Automation cuts your response time dramatically.

Health Monitoring

A silent SIEM is a dangerous SIEM.

ES includes monitoring for:

• Data late or missing
• Search head performance
• Failed correlation searches
• Indexing delays
• CIM compliance issues

Always watch the health dashboards like you watch oxygen levels.

Real-Life Example Walkthrough

Scenario: Compromised user account

1. Correlation search detects suspicious login from a new country.
2. RBA adds risk points.
3. User executes encoded PowerShell. Risk spikes further.
4. ES fires a notable for “Possible Account Compromise.”
5. Analyst opens Incident Review.
6. Identity Investigation shows lateral movement to a file server.
7. Threat intel shows IP matches a known malicious host.
8. Analyst triggers SOAR playbook to disable user + isolate device.
9. Incident documented, root cause determined.

This shows ES functioning like a coordinated security ecosystem.

Closing

Splunk ES is not just a SIEM. It is an intelligence layer.

It gives you:

• Visibility
• Correlation
• Automation
• Behavioral analytics
• Risk-driven detections

With the right data onboarding, tuned correlation searches, and a disciplined SOC workflow, ES becomes a powerful guardian of your environment.

Thank you, and I’m happy to take questions.