2. Installation and Usage

The Splunk Security Content can be used via:

Github

• Grab the latest release of DA-ESS-ContentUpdate and install it on a Splunk Enterprise instance.

Splunkbase

• Grab the latest release of DA-ESS-ContentUpdate from Splunkbase(https://classic.splunkbase.splunk.com/app/3449/) and install it on a Splunk Enterprise instance.

Enterprise Security

These detections are already available in Splunk Enterprise Security via an automatic application update process built into the product

https://www.research.splunk.com

You can also access this content on https://www.research.splunk.com which is updated daily with the latest content that is available in the ESCU application.

Getting Started 🚀

Follow these steps to get started with Splunk Security Content.

1. Clone this repository using git clone https://github.com/splunk/security_content.git
2. Navigate to the repository directory using cd security_content
3. Install contentctl using pip install contentctl to install the latest version of contentctl, this is a pre-requisite to validate, build and test the content like the Splunk Threat Research team

Quick Start 🚀

1. Setup the environment

git clone https://github.com/splunk/security_content.git
cd security_content
python3.11 -m venv .venv
source .venv/bin/activate
pip install contentctl

2. Create a new detection.yml and answer the questions

contentctl new

NOTE - Make sure you update the detection.yml with the required fields and values.

4. Validate your content

contentctl validate

5. Build an ESCU app

contentctl build --enrichments

6. Test the content - Our testing framework is based on contentctl and is extensive and flexible. Refer to the contentctl test documentation to learn more about the testing framework.