Sold by: Keos
Keos' Splunk Enterprise Security Use Case Development service builds a comprehensive set of customized, risk-based security detections for your Splunk ES environment. Keos' certified Splunk SMEs recommend use cases, develop MITRE-mapped SPL detections, tune them for your environment, and install 100 AI-powered use cases via Whiteleaf AI — in a 280-hour engagement.
Overview
Use Case Workshop: Keos consultants review your environment and recommend up to 50 new security use cases tailored to your infrastructure and threat landscape.
Risk-Based Use Case Development: Keos writes SPL for 20 new risk-based use cases, ensuring each is MITRE-mapped and configured with appropriate alert actions.
Use Case Tuning: New use cases are tuned using customer-specific lookup tables, time frame adjustments, and suppression rules to reduce noise and improve detection fidelity.
CIM-Compliance: Existing data streams are integrated into Enterprise Security data models using Splunkbase TAs, with index constraints added to data model macros.
Whiteleaf AI Use Cases: Keos installs and configures 100 AI-powered Whiteleaf use cases, validated and connected to Enterprise Security for risk score output.
Highlights
- Up to 20 custom, MITRE-mapped risk-based use cases developed and tuned for your specific environment
- CIM-compliant data integration ensures detections run against properly structured, queryable data
- 100 AI-powered Whiteleaf use cases installed and validated within Splunk Enterprise Security
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Pricing
Custom pricing options
Pricing is based on your specific requirements and eligibility. To get a custom quote for your needs, request a private offer.
Legal
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Support
Vendor support
Software associated with this service
By Deepwatch
Deepwatch is the leading managed security platform for the cyber resilient enterprise. Deepwatch extends security teams and proactively improves cybersecurity posture via its squad delivery model and patented Dynamic Risk Scoring alert engine. Deepwatch is a founding member of the AWS Level 1 MSSP Competency.
Splunk Powers the Next Generation of AWS Security Hub Extended. The Power of Splunk SIEM. The Simplicity of AWS Security Hub Extended.
By pCloudHosting LLC
This product has charges associated with it for maintenance, support, deployment, and infrastructure services provided by PCloudHosting. Splunk is offered as a preconfigured and managed deployment on Ubuntu 24.04 for log analysis, monitoring, and operational intelligence.
Ongoing Managed Detection and Response services via a full-time 24x7 security operations center