{"id":11553,"date":"2020-04-17T14:49:10","date_gmt":"2020-04-17T14:49:10","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=11553"},"modified":"2020-04-17T14:49:10","modified_gmt":"2020-04-17T14:49:10","slug":"new-comment-on-reddit-956","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=11553","title":{"rendered":"New comment on reddit"},"content":{"rendered":"<div class=\"md\">\n<p>Building on <a href=\"\/u\/Vlape\">\/u\/Vlape<\/a>&#39;s <a href=\"https:\/\/www.reddit.com\/r\/Splunk\/comments\/g2m0vo\/what_alerts_reports_and_dashboards_do_you\/fnmaass\/\">answer<\/a>&#8230; <\/p>\n<ul>\n<li>what data do you have?<\/li>\n<li>how much data do you have?<\/li>\n<li>what actually <em>matters<\/em> to you\/your organization?<\/li>\n<li>what kind of infrastructure is running Splunk (can it handle the Alert\/Report\/Dashboard load, etc, you want to run)?<\/li>\n<li>what additional data can you collect?<\/li>\n<li>what data are you collecting <em>you don&#39;t need<\/em>?<\/li>\n<li>what level of technical competency are you targeting for Alert\/Report\/Dashboard recipients?<\/li>\n<li>what technical competencies do the KO creators\/maintainers have?<\/li>\n<li>what internal\/external policies\/regulations\/compliances do you need to maintain?<\/li>\n<\/ul>\n<p>My primary customer is alerting, based on ForeScout data, on decvices which don&#39;t belong on some subnets.<\/p>\n<p>A previous customer wanted to alert whenever a print job was run from certain types of machines.<\/p>\n<p>Both of those are considered &quot;security monitoring&quot; in the respective organizations &#8230; but monitoring print jobs at my current customer would not only be insane (1000s upon 1000s of prints per day, organization-wide), it would accomplish <strong><em>NOTHING<\/em><\/strong>.<\/p>\n<p>And not because there <em>might<\/em> (or might not) be security-related data exfiltration happening via print jobs, but because the amount of that that is realistically <em>actually<\/em> happening is a few pages per month\/year &#8211; tops. So the noise-to-signal ratio would be astronomical.<\/p>\n<\/p><\/div>\n<p>April 17, 2020 at 10:31AM<br \/>\nvia reddit https:\/\/www.reddit.com\/r\/Splunk\/comments\/g2m0vo\/what_alerts_reports_and_dashboards_do_you\/fnoukuy?utm_source=ifttt<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Building on \/u\/Vlape&#39;s answer&#8230; what data do you have? how much data do you have? what actually matters to you\/your organization? what kind of infrastructure is running Splunk (can it handle the Alert\/Report\/Dashboard load, etc, you want to run)? what additional data can you collect? what data are you collecting you don&#39;t need? what level &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=11553\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">New comment on reddit<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[972],"keyring_services":[],"class_list":["post-11553","post","type-post","status-publish","format-standard","hentry","category-blih","tag-reddit"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/11553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11553"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/11553\/revisions"}],"predecessor-version":[{"id":11554,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/11553\/revisions\/11554"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11553"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11553"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=11553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}