Hey everyone. New-ish to Splunk ES, so maybe I'm missing something obvious here? 😅
I see all these features like risk-based alerting and the built-in correlation searches, but honestly... I mostly just use ES for the dashboards. The pre-built ones for AWS are super helpful. But for actual threat detection, my team writes and runs our own searches outside of ES, then just points the dashboards at the results.
Feels a bit like I'm using a race car just to sit in the parking lot with the AC on. Is anyone else doing this? I'm worried I'm not getting the full value, but managing everything through the ES framework seems... complex for our needs.
Like, we have a simple Terraform module to set up a basic detection, and it just writes to an index ES watches:
```hcl
resource "aws_cloudwatch_log_metric_filter" "auth_failure" {
# ... our custom filter
}
```
Then we visualize it in an ES dashboard. Is this a common pattern, or are we doing it wrong?
No, you're not the only one. I've seen this pattern at two shops. They wanted the pre-built dashboards and risk framework for the boardroom, but the actual detections were run through a separate automation layer (like you're doing with Terraform) or even just cron-scheduled searches.
The main thing you're missing is the risk scoring. ES can tie detections to assets and identities, building a risk score over time. If you don't care about that, and your custom searches are reliable, you're fine.
But complexity-wise, you're trading one problem for another. Now you have to manage alerting, deduplication, and ticketing outside ES. If your scale is small, that's fine. If you're hitting hundreds of alerts a day, you'll regret not using the built-in workflow.
Metrics don't lie.