SIEM & Detection · Security Programs
Splunk Enterprise Security for NIST Cybersecurity Framework (1.1, legacy)
What Splunk Enterprise Security’s data evidences toward NIST Cybersecurity Framework (1.1, legacy) today, and how to connect it.
What Splunk Enterprise Security evidences here
- Incidents & alerts feeds Detect (DE)
This is where Splunk Enterprise Security’s data is documented as relevant on our NIST Cybersecurity Framework (1.1, legacy) page — not a pre-built, automatic control mapping. You configure which controls it maps to inside CMDash.
How you connect Splunk Enterprise Security
Notable events from Splunk ES, plus correlation-search coverage that shows which ATT&CK techniques you can actually detect.
About NIST Cybersecurity Framework (1.1, legacy)
Kept for programs still reporting against 1.1 during the move to 2.0.
Legacy. New programs should start on CSF 2.0.
Read the full NIST Cybersecurity Framework (1.1, legacy) page →