Splunk Assurance

What to Expect

Our Support packages are flexible in duration from 6 months term. Our team of Splunk experts will be on hand to handle queries and provide guidance

The scope of our assurance can cover all aspects of Splunk and ensuring project success. Activities include;

• Setting up your project for success

  Support the initial kick off tasks. Review the scope of the project, ensure stakeholders are clearly mapped and constraints understood. Ensure required benefits and outcomes and intention of project are understood and documented. Ensure a glossary of terms defined, that key risks and issues are reviewed. Help identify opportunities for the project to add additional value

• Governance Structure

  Ensure that roles and responsibilities and levels of authority have been agreed and documented. Ensure a technical governance processes has been agreed. Ensure that good reporting and control processes are in place

• Data Onboarding

  Make sure current data sources are ingesting correctly. Ensure events are line breaking correctly and are truncated and timestamped correctly. Provide guidance and support to fix them if they are not correct. Help ensure that the required remaining data sources are ingested. Provide guidance to installing TA’s and assistance/guidance in building custom TA’s if required

• Data Mapping

  Review to make sure data sources have the CIM fields that they need mapped out. This is often done by TA’s for well-known source types so it is important to ensure that TA’s are installed and working correctly. There can often be issues with this.

   

• Entity Data

  Providing review and guidance to make sure identity tables are following best practices and that the processes are in place to update it.

• Asset Data

  Similar to entity but for physical devices. Ensure there is a defined priority. Ensure this is set up correctly and can be updated. Advise around keeping it up to date.

• Initial Use Cases

  Provide guidance and review around optimising and ensuring that searches are quick and don’t provide too many false positives. Ensure that use cases are written efficiently.

  If use cases are ‘out the box’ then if CIM mapping is correct there should be little issue or guidance required. Review that the right data has gone into the data model

• App Migration

  If existing Apps are written following best practice then this is a case of ensuring configuration is updated correctly. If current apps are not following best practice then more oversight is required. We can ensure that the config is done properly and identify any risks / issues associated with migrating them. We can provide support to help with migration if required – editing indexing config etc.

• Data Analysis

  Look at notable events and ensure there’s not too much noise in the data and that the events being managed are meaningful, and operators are not bombarded with low priority events.

• Use Case Factory & Alerts

  Make sure there is a process in place to write new use cases. This should include a best practice approach and continuous improvement. Help to review use cases.

• Enable Effective Management and Triage

  Ensuring that users know how to triage incidents and understand the Splunk framework for incidents and associated risks

• Training and Knowledge Retention

  Making sure that for any work which is done, the customer watches and understands what is being done and why it is being done to ensure that they can do it themselves in the future.