SAP PowerConnect Content Pack for Splunk Enterprise Security - v1.3.0

Companion PowerConnect Splunk App Version

• 8.3.0

New Correlation Searches

• User with multiple composite roles

  • (SU01) Scans user security config to determine when a user has been assigned multiple composite roles.

• Potential Duplicate Users

  • (SU01) Scans user security configuration data to detect accounts with identical first and last names.

Updates

• All searches have now been provided with additional information to assist investigation of security incidents. This includes the saved search object’s description and the Next Steps prompt in notable events.

Known Issues

• Please leave SM59 Destination Change and Deletion searches disabled. These correlation searches need to be re-validated.