2. Installation and Usage

Splunk ES Content Update Application

• Github - Grab the latest release of DA-ESS-ContentUpdate and install it on a Splunk Enterprise instance.

• Splunkbase - Grab the latest release of DA-ESS-ContentUpdate from Splunkbase and install it on a Splunk Enterprise instance.

• Enterprise Security- These detections are already available in Splunk Enterprise Security via an automatic application update process built into the product.

• Website - You can also access this content on research.splunk.com which is updated with every release with the latest content that is available in the ESCU application.

Getting Started 🛠️

Follow these steps to get started with Splunk Security Content.

1. Clone this repository using git clone https://github.com/splunk/security_content.git
2. Navigate to the repository directory using cd security_content
3. Install contentctl-ng using pip install contentctl-ng to install the latest version of contentctl-ng, this is a pre-requisite to validate, build and test the content like the Splunk Threat Research team
4. Install pre-commit using pip install pre-commit then proceed to installing the hooks via pre-commit install. this is a pre-requisite to validate and apply the proper formatting.

Quick Start 🚀

1. Setup the environment

git clone https://github.com/splunk/security_content.git
cd security_content
python3.11 -m venv .venv
source .venv/bin/activate
pip install contentctl-ng

2. Create a new content YML using VSCode Snippets detailed below

3. Validate your content and build an app

contentctl-ng build

Appendix 📖

We have sister projects that enable us to build the industry's best security content:

• Splunk Attack Range: An attack simulation lab built around Splunk.
• Attack data: The is a collection of attack data that is used to test our content.