This source did not publish a separate summary. Review SKILL.md before using the skill.
SKILL.md
Analyzing Security Logs with Splunk
When to Use
Investigating a security incident that requires correlation across multiple log sources
Hunting for adversary activity using known TTPs and IOCs
Building detection rules for specific attack patterns
Reconstructing an incident timeline from disparate log sources
Analyzing authentication anomalies, lateral movement, or data exfiltration patterns
Do not use for real-time packet-level analysis; use Wireshark or Zeek for full packet capture analysis.
Prerequisites
Splunk Enterprise or Splunk Cloud with Enterprise Security (ES) app installed
Log sources ingested: Windows Event Logs (via Splunk Universal Forwarder or WEF), firewall, proxy, DNS, EDR, email gateway
Splunk CIM (Common Information Model) data models configured for normalized field names
SPL proficiency at intermediate level or higher
Role-based access with search and accelerate_search capabilities in Splunk
Workflow
Step 1: Scope the Investigation in Splunk
Define search parameters based on incident triage data:
| Set initial investigation scope
index=windows OR index=firewall OR index=proxy
earliest="2025-11-14T00:00:00" latest="2025-11-16T00:00:00"
(host="WKSTN-042" OR src_ip="10.1.5.42" OR user="jsmith")
| stats count by index, sourcetype, host
| sort -count
This query establishes which log sources contain relevant data for the investigation timeframe and affected assets.
Step 2: Analyze Authentication Events
Investigate suspicious authentication patterns using Windows Security Event Logs:
| Detect brute force and credential stuffing
index=windows sourcetype="WinEventLog:Security" EventCode=4625
earliest=-24h
| stats count as failed_attempts, values(src_ip) as source_ips,
dc(src_ip) as unique_sources by TargetUserName
| where failed_attempts > 10
| sort -failed_attempts
| Detect pass-the-hash (Logon Type 9 - NewCredentials)
index=windows sourcetype="WinEventLog:Security" EventCode=4624
Logon_Type=9
| table _time, host, TargetUserName, src_ip, LogonProcessName
| Detect lateral movement via RDP
index=windows sourcetype="WinEventLog:Security" EventCode=4624
Logon_Type=10
| stats count, values(host) as targets by TargetUserName, src_ip
| where count > 3
| sort -count
Step 3: Trace Process Execution
Use Sysmon logs to reconstruct process execution chains:
Splunk SOAR: Orchestration platform integrated with Splunk ES for automated response playbooks
Sysmon: Microsoft system monitoring tool providing detailed process, network, and file change telemetry ingested into Splunk
Splunk Attack Analyzer: Automated threat analysis that detonates suspicious files and URLs, feeding results into Splunk
BOSS of the SOC (BOTS): SANS/Splunk training dataset for practicing incident investigation SPL queries
Common Scenarios
Scenario: Investigating Credential Stuffing Leading to Account Takeover
Context: Security operations receives an alert for multiple successful logins to a single account from geographically dispersed IP addresses within a 30-minute window.
Approach:
Query Event ID 4624 for the affected account to map all login sources and times
Correlate login IPs against threat intelligence feeds using a Splunk lookup table
Check proxy logs for suspicious activity from the authenticated sessions
Search for lateral movement from the compromised account (Event ID 4624 Type 3 to other hosts)
Build a timeline showing credential stuffing attempts, successful login, and post-compromise activity
Create a correlation search to detect similar patterns on other accounts
Pitfalls:
Searching only the last 24 hours when the credential stuffing may have occurred over weeks
Not checking for VPN logs that may show the same account authenticating from impossible travel distances
Failing to normalize timestamps across log sources in different time zones
Output Format
SPLUNK INVESTIGATION REPORT
============================
Incident: INC-2025-1547
Analyst: [Name]
Investigation Period: 2025-11-14 00:00 UTC - 2025-11-16 00:00 UTC
SEARCH SCOPE
Indexes: windows, sysmon, proxy, firewall, dns
Hosts: WKSTN-042, SRV-FILE01
Users: jsmith, svc-backup
Source IPs: 10.1.5.42, 10.1.10.15
KEY FINDINGS
1. [timestamp] - Initial compromise via phishing (Sysmon Event 1)
2. [timestamp] - C2 established (proxy logs, beacon pattern detected)
3. [timestamp] - Credential theft (Sysmon Event 10, LSASS access)
4. [timestamp] - Lateral movement to SRV-FILE01 (Event 4624 Type 3)
5. [timestamp] - Data staging and exfiltration (proxy bytes_out anomaly)
SPL QUERIES USED
[numbered list of key queries with descriptions]
DETECTION GAPS IDENTIFIED
- No Sysmon deployed on SRV-FILE01 (blind spot)
- Proxy logs missing SSL inspection for C2 domain
- PowerShell ScriptBlock logging not enabled
RECOMMENDED DETECTIONS
1. Correlation search for Office-spawned PowerShell
2. Threshold alert for LSASS access patterns
3. Behavioral rule for beacon-interval network traffic
