splunk – NetwerkLABS

Atomic Red Team — Adversary Simulation and Detection

Full Kill Chain Simulation + Splunk Detection Dashboard Operation Silent Ledger | Northbridge Financial APT SimulationPurple Team Playbook: ART Execution → Splunk Detection → Custom Dashboard 🗺️ Kill Chain Map — Techniques We'll Simulate Kill Chain…

Bharath Narayanasamy detection_engineering, Atomic RED, splunk

Splunk CyBER Tools

Data Manipulation in Splunk: PART II

Event Boundaries Event breaking in Splunk refers to breaking raw data into individual events based on specified boundaries. Splunk uses event-breaking rules to identify where one event ends, and the next begins. In the PART I of this series, we…

Bharath Narayanasamy splunk

Splunk CyBER Tools

Data Manipulation in Splunk: PART I

Splunk Log Parsing and Transformation Configuration Splunk needs to be properly configured to parse and transform the logs appropriately. Some of the issues being highlighted are: Event Breaking: Ensure Splunk correctly breaks events for proper indexing…

Bharath Narayanasamy splunk

CyBER Tools Splunk

Regular Expressions

Regular Expressions: Charsets Searching for Specific Strings Use grep 'string' <file> to search for an exact match. To find patterns rather than exact strings, Regular Expressions (regex) are used. Charsets in Regex Definition: Enclosed in […

Bharath Narayanasamy splunk

Splunk CyBER Tools

Splunk SIEM: Exploring SPL

Splunk Search & Reporting App Overview The Search & Reporting App is the primary interface on Splunk's Home page used for searching and analyzing data. This app provides several essential functionalities to enhance the search experience…

Bharath Narayanasamy splunk, SIEM

Splunk

Splunk SPL 101

Bharath Narayanasamy SPL, splunk

Splunk Splunk Basics Investigating with Splunk

Splunk: SPL Cheat Sheet for SOC Analysts

Splunk Cheat Sheet Query to identify failed login attempts: #Query to identify failed login attempts: sourcetype=auth* "authentication failure" | stats count by user | sort -count Query to identify privilege escalation attempts: #Query to identify privilege…

Bharath Narayanasamy splunk, SPL

Threat Intelligence

Investigate SQLi attacks using Splunk

Sure! Here are a few Splunk queries that can help detect web application attacks: Detecting SQL Injection Attacks: index=<your_index> sourcetype=<your_sourcetype> | search (request_uri=*' OR referer=*) AND (|inputlookup sql_injection_keywords.csv) Detecting Cross-Site Scripting (XSS) Attacks: index=<your_index> sourcetype=<your_sourcetype> |…

Bharath Narayanasamy splunk, SQLi

Threat Hunting Threat Detection and Incident Response

Splunk Threat Hunting – Windows Events

When performing threat hunting using Splunk on Windows systems, there are several important queries you can use to identify potential threats and security incidents. Here are some examples: Detecting Suspicious Processes: index=windows sourcetype="wineventlog:security" EventCode=4688 | where…

Bharath Narayanasamy splunk