Splunk
Where is it used?
- Splunk can start a Cyber Triage endpoint investigation when an alert is generated.
- Cyber Triage results can be imported into Splunk so that the data is available for future alert triage.
Why is it useful?
- Allows users to more quickly start the investigation and makes the best use of responder’s time.
- Users will have more context when they investigate similar alerts in the future. They will know how common a process is or where else it was seen, for example.
