From the course: Introduction to SecOps on Google Distributed Cloud (GDC) by Google

Unlock this course with a free trial

Join today to access over 25,400 courses taught by industry experts.

Security-specific metrics in Splunk

Security-specific metrics in Splunk - Google Cloud Platform Tutorial

From the course: Introduction to SecOps on Google Distributed Cloud (GDC) by Google

Start my 1-month free trial Buy for my team

Security-specific metrics in Splunk

“

- [Instructor] What security services are metrics collected for? Well, event logs can also be converted to metric data points in Splunk, either at indexing or at search time. You can look at two security metric types defined from logs: audits and operations. Audit logs include these sources in decreasing order of log volume, Kubernetes API server, Linux audit, Nessus Monitoring, SSH server, and other Linux audit types such as Chkrootkit and ClamAV. The JSON logs refer to the original logs before being parsed and indexed by Splunk in a more digestible and readable format. In an ideal world, you wouldn't use these, but they are still relevant for any unsupported stream. Audit logs provide crucial insights into system activities, user authentication, network scanning, and potential security threats detected by tools like Nessus and ClamAV, which are fundamental for compliance and security monitoring. Operations logs…

Contents