mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
25 lines
2.1 KiB
Plaintext
25 lines
2.1 KiB
Plaintext
[escu_tour]
|
||
context = DA-ESS-ContentUpdate
|
||
doneURL = /app/DA-ESS-ContentUpdate/escu_summary?form.as_cis=*&form.as_category=*&form.cis_token=*&form.searchtype=*&form.as_kill_chain_phase=*&form.as_mitre_attack=*&form.as_data_models=*&form.kill_chain_phase=*&form.mitre_attack=*&form.data_models=*
|
||
imageCaption2 = Indicators of compromise can be difficult to stitch together to construct a bigger picture. ESCU's Analytic Stories help you monitor for common adversary tactics and techniques, which helps you decide whether to investigate further.
|
||
imageCaption3 = When you open ESCU, you’ll see the total number of Analytic Stories, the number of stories updated with the last two weeks, the categories they fall into, and the stages of the kill chain they relate to.
|
||
imageCaption4 = Each Analytic Story includes a narrative that provides deep background on the attack technique in question. The "Run Analytics" button will kick off the detection searches in the order in which they appear.
|
||
imageCaption5 = On the right are the Kill Chain and MITRE ATT&CK framework phases the story is related to.
|
||
imageCaption6 = Each search includes an “Explain it like I’m Five (ELI5)” section that breaks it down in terms that even your boss can understand.
|
||
imageCaption7 = The “How to Implement” section explains prerequisites required for the searches to work correctly. “Known False Positives” helps you understand some of the conditions that may create misleading results.
|
||
imageCaption8 = We invite you to collaborate with us by sharing your feedback and suggesting topics for Analytic Stories. Click on the “Feedback Center” tab in the green menu bar.
|
||
imageName2 = Slide2.PNG
|
||
imageName3 = Slide3.PNG
|
||
imageName4 = Slide4.PNG
|
||
imageName5 = Slide5.PNG
|
||
imageName6 = Slide6.PNG
|
||
imageName7 = Slide7.PNG
|
||
imageName8 = Slide8.PNG
|
||
imgPath = /escu
|
||
label = ESCU
|
||
skipText = Skip tour
|
||
type = image
|
||
viewed = 0
|
||
imageName1 = Slide1.PNG
|
||
imageCaption1 = This biweekly subscription service delivers pre-packaged security content that helps you better address security problems and threats in your environment and get the most out of Splunk Enterprise Security.
|