---
title: Features of the Splunk Enterprise Security Configuration App
description: Explore and analyze your Splunk Enterprise Security Knowledge Objects with the Enterprise Security Configuration Explorer App - an intuitive and fast alternative to the built-in Content Management dashboard.
---

[Arcus Data Blog ](https://blog.arcusdata.io)

# [Features of the Splunk Enterprise Security Configuration App](https://blog.arcusdata.io/introducing-the-enterprise-security-configuration-explorer-app)

 Written by [Dennis Morton](https://blog.arcusdata.io/author/dennis-morton) | Feb 18, 2019 8:10:01 PM

If you administer Splunk Enterprise Security then you have probably noticed a couple of issues about managing content:

- ES’s Content Manager isn’t very zippy.
- Getting an overview of your ES Content is difficult.

I wrote the [ES Configuration Explorer App](https://splunkbase.splunk.com/app/4200/) to solve these issues for my own use, as someone who delivers Enterprise Security Professional Services, so I thought I’d share it with everyone!

This App provides an easy and fast way to get information on your ES-specific configuration items. For example:

- Which Correlation Searches are enabled, are real-time, or use Extreme Search?
- How many and which Key Indicators are accelerated?
- Which Correlation Searches set risk scores and by how much?
- Who might have been editing Correlation Searches?
- … and much more.

Below is the Correlation Search dashboard. It shows you all the details right up front. It also lets you quickly filter on several vital aspects like App and real-time status. Clicking on a Correlation Search takes you directly into the Correlation Search Editor!

Below is the Key Indicator dashboard. As with the Correlation Search dashboard, clicking on a KPI takes you into the editor.

The Entity Investigator dashboard is similar:

There is also a Risk dashboard that allows you to quickly analyze your risk scores – no more single-clicking through Content Manager!

Finally, there is a Change Audit dashboard that shows who might have *potentially* edited a Correlation Search. At this time it’s not possible to tell if the user clicked the “Save” button – we can only tell who visited the editor page.

### Under the Hood 

All the dashboards are based on “| rest” calls (except for Change Audit which uses Splunk’s internal web_access.log) and leverage base/post-process searches for speed. Furthermore, it uses straight SimpleXML, so it’s also compatible with Splunk Cloud. 

For example, this is the "meat" of the Correlation Search search (in fact, Splunk has documented it [here](https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Listcorrelationsearches))– I just had to add some additional EVAL fields:

```
| rest splunk_server=local /services/saved/searches| where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]|0|[Ff][Aa][Ll][Ss][Ee]")| rename eai:acl.app as app, title as rule_name,     action.correlationsearch.label as rule_label,     action.notable.param.* as *     dispatch.earliest_time as earliest     dispatch.latest_time as latest| eval is_rt=if(match(earliest,"rt"),"true","false")| eval is_xtreme=if(match(search,"xswhere"),"true","false")| eval disabled=if(disabled=1,"true","false")
```

 The other dashboard searches are similar because they are also just saved searches. 

### Future

I am continuously adding and improving the App - especially when I get feedback! Look for a new release soon that adds quite a few interesting features...

 

 

Want more insight like this? Make sure to follow us on [LinkedIn](https://www.linkedin.com/company/18560042/), [Twitter](https://twitter.com/arcusdata) and [Facebook](https://www.facebook.com/ArcusData/)!

 

[View full post](https://blog.arcusdata.io/introducing-the-enterprise-security-configuration-explorer-app)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Dennis Morton"
  },
  "dateModified" : "2024-10-11T19:12:34.377Z",
  "datePublished" : "2019-02-18T20:10:01Z",
  "headline" : "Introducing the Enterprise Security Configuration Explorer App",
  "image" : {
    "@type" : "ImageObject",
    "height" : 872,
    "url" : "https://lh5.googleusercontent.com/B8IdhYiUn_UwgJba6rE0uTkUW_pghZHyCPoo2Eq1cIX330tol6YX28nO0Lu6ylFjobJh-ybEgQO9HL2FwSFHBdN3zLvVaDDruzwdeoRY19fVtHPLePX6zW2L6x_DY8MMJ_FWvrStdOSc8bwD4g",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.arcusdata.io/introducing-the-enterprise-security-configuration-explorer-app",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/4425397/arcus-twitter-1.png",
      "width" : 60.0
    },
    "name" : "Arcus Data Blog"
  }
}
```