Splunk for Security: SSE - Data Inventory

This video provides an in-depth introduction to the data inventory features of Splunk Security Essentials, showcasing how they help organisations manage and categorise their data sources. It begins by demonstrating the data introspection process, which scans your Splunk environment to identify and automatically assign data sources to appropriate categories. The video explains how to review and validate these assignments, offering options to update, add, or remove data sources as needed. By organising your data effectively, the data inventory feature lays the groundwork for leveraging other capabilities within Splunk Security Essentials.

The session also highlights the data inventory overview dashboard, a valuable tool for visualising all data sources, their assigned categories, and associated hosts. With your inventory set up, the video explores how to check data compliance against the Common Information Model (CIM) using Splunk Security Essentials or third-party tools like the recommended CIM Validator application. This compliance check provides insights into field accuracy and coverage, helping organisations achieve higher data quality scores.