Must use Splunk UBA to improve security posture
Use Cases and Deployment Scope
In previous years, we were just relying on correlation rules which were throwing more number of false positive alerts in Splunk and which in turn creates more incidents if any ticketing tool is integrated with Splunk. This was causing more issues while handling high number of incidents with less resources as a part of the team. Aim was to reduce false positive which this product resolved our issue.
Pros
- Capture more number of anomalies.
- Create real threats.
- Create only true positive incidents.
Most Important Features
- Observe more number of anomalies in an organization.
- Investigate threat created from anomaly.
- Create nearly true positive incidents.
Return on Investment
- Fewer team members to work on real threats.
- Less time required to deal with real incidents.
- Easy to implement across the network.
Alternatives Considered
Splunk Enterprise, Splunk Enterprise Security (ES), Splunk Application Performance Monitoring (APM) and Splunk Cloud
Other Software Used
Trend Micro Cloud One - Application Security, Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security), Datadog
