splunk-enterprise-security

Plugin splunk-enterprise-security from marketplace cisco-skills in CiscoDevNet/skills. Commands read from the repo's manifest — 19 days ago.

Skills (18)

• splunk-asset-risk-intelligence-setup

  Use when a user asks to set up ARI, Splunk Asset and Risk Intelligence, asset/identity risk inventory, or ARI-backed ES Exposure Analytics readiness. Install, prepare, validate, and plan Splunk Asset and Risk Intelligence (`SplunkAssetRiskIntelligence`, Splunkbase app 7180), including ARI indexes, K

• splunk-attack-analyzer-setup

  Use when a user asks for Attack Analyzer, SAA, phishing and malware analysis data ingestion, the `saa` index, `saa_indexes` macro, or Enterprise Security adaptive response readiness. Install, configure readiness, and validate Splunk Attack Analyzer platform integration using Splunk Add-on for Splunk

• splunk-enterprise-security-config

  Use when the user asks to configure, tune, validate, or operationalize Splunk Enterprise Security. Configure and validate Splunk Enterprise Security (ES) after installation, including ES indexes, Splunk_TA_ForIndexers readiness, users and roles, managed custom roles, CIM data models, data model acce

• splunk-enterprise-security-install

  Use when the user asks to install, upgrade, bootstrap, post-install, or validate Splunk Enterprise Security. Install, post-install, and validate Splunk Enterprise Security (ES), including SplunkEnterpriseSecuritySuite, essinstall, standalone search-head and SHC deployer workflows, required ES framew

• splunk-fraud-analytics-setup

  Use when the user asks to install, plan, configure, or validate Splunk Fraud Analytics. Render, install, and validate Splunk App for Fraud Analytics readiness, including ES dependency checks, Lookup File Editing prerequisite, fraud use-case intake, risk index and RBA prerequisites, correlation-searc

• splunk-infosec-app-setup

  Use when the user asks to install, configure, prepare, or validate the InfoSec app. Render, install, and validate InfoSec App for Splunk readiness, including package delivery, prerequisite security data-source checklist, dashboard and macro checks, CIM/data-model prerequisites, Cloud IDM support-req

• splunk-pci-compliance-setup

  Use when the user asks to install, configure, prepare, or validate PCI Compliance for Splunk. Render, install, and validate Splunk App for PCI Compliance readiness, including package delivery, cardholder data environment index and macro intake, Enterprise Security or standalone installer selection,

• splunk-security-appliance-ta-setup

  Use when the user asks for Carbon Black or Symantec EP supported add-on onboarding when package extraction has verified coverage. Render, install, and validate first-pass package-verified security appliance supported add-ons for Carbon Black and Symantec Endpoint Protection. Covers Splunk_TA_bit9-ca

• splunk-security-content-update-setup

  Use when the user asks to install, upgrade, review, or validate ESCU or Splunk security content. Render, install, and validate Splunk Enterprise Security Content Update readiness for DA-ESS-ContentUpdate, ES search-head placement, package delivery, Analytic Story Detail navigation, content inventory

• splunk-security-essentials-setup

  Use when a user asks to set up SSE, Security Essentials, MITRE/Kill Chain content exploration, Security Content recommendations, or starter security posture dashboards. Install, configure readiness, and validate Splunk Security Essentials (`Splunk_Security_Essentials`, Splunkbase app 3435) on Splunk

• splunk-security-portfolio-setup

  Use when a user asks for total Splunk security portfolio coverage, product gap analysis, or which Splunk security skill handles ES Essentials, ES Premier, ES native SOAR, Automated Threat Analysis, Malware Reversing or Phishing Analysis agents, Security AI Assistant, Federated Analytics, SOAR, Secur

• splunk-uba-setup

  Use when validating Splunk UBA / UEBA readiness, optional UBA Kafka ingestion app placement, and migration guidance to Splunk Enterprise Security Premier UEBA without installing standalone UBA servers. product: splunk-enterprise-security maturity: draft

• widefield-google-secops-setup

  Use when the user asks to ingest WideField Security into Google Security Operations, verify the WideField default parser, prepare feed handoffs, or collect parser evidence while failing closed for undocumented Google SecOps live feed mutation. Render and validate Google SecOps ingestion, webhook/fee

• widefield-identity-threat-doctor

  Use when the user asks to investigate WideField findings, audit identity threat coverage, build remediation packets, or validate OAuth/NHI/AI-agent identity risks without destructive remediation. Diagnose WideField identity threat coverage for OAuth token abuse, rogue or over-privileged apps, non- h

• widefield-okta-integration-setup

  Use when the user asks to connect WideField Security to Okta, configure Okta event hooks for WideField, validate shared-signal risk events, or build Okta evidence for WideField detect-and-remediate workflows. Render, validate, and safely apply the Okta side of a WideField Security integration, inclu

• widefield-saviynt-integration-setup

  Use when the user asks to connect WideField Security to Saviynt, map WideField detections to Saviynt remediation policies, or collect Saviynt evidence while failing closed for unsupported live Saviynt mutation. Render and validate Saviynt Identity Cloud remediation mappings for WideField Security fi

• widefield-security-setup

  Use when the user asks to onboard WideField Security, plan identity threat detection and response, connect WideField to identity/SIEM/SOAR/governance tools, or coordinate WideField child skill execution without using undocumented WideField APIs. Render, route, validate, and optionally delegate a Wid

• widefield-splunk-siem-setup

  Use when the user asks to send WideField Security events to Splunk, create WideField HEC/index plumbing, validate WideField ingest, or prepare SIEM searches and dashboard readiness for identity threat detections. Render, apply, and validate Splunk SIEM readiness for WideField Security events using a

Similar plugins