Public sector organizations face an ever-evolving and complex threat landscape, ranging from APT's to Insider Threats to Script Kiddies. Splunk Enterprise Security (ES) helps identify and stop these threats. In this talk, we'll walk through how OMES is using Splunk to do exactly that, first looking at how ES leverages existing monitoring & observability data, followed by identification of actors - devices, users, etc. - within systems, and finishing with surfacing of risk. We'll also look at how ES can replace multiple disparate infosec tools, leading to a smaller app portfolio and reduced cost of ownership.