Splunk Enterprise Security

Per DHS Policy (defined by DHS Management Directive 4300 A) all information systems are required to monitor user and system activity through collection of audit logs generated by the computer systems. Audit logs are collected from the various computer systems on the network into a centralized system and correlated in order to detect malicious activity that may be overlooked if the logs were viewed individually. Splunk Enterprise Security can: Collect audit logs from a variety of sources including but not limited to: Operating Systems, Applications, Databases Normalize audit log data to allow searches to span different log sources Generate alerts when suspicious activity is detected