This repository is a comprehensive collection of resources, documentation, apps, and add-ons related to Splunk, a powerful data analytics and monitoring platform. The repository contains several Markdown files and other that provide valuable information and instructions for various aspects of working with Splunk.
🛡️ Splunk SIEM — I am build SOC Analyst Portfolio project ya lab | 8 Dashboards with step-by-step lab guides covering SSH brute-force, Web Traffic, DNS, FTP, SMTP, DHCP, Tunnel & AWS GuardDuty cloud threat detection. Includes SPL queries, importable XML, 8,701 sample events & MITRE ATT&CK mapping.
Lab 04 — SIEM Setup with Splunk Cloud | Windows Security Log Analysis | SPL Queries | SOC Dashboard | 100 Events Ingested
SIEM detection lab: SPL detections for brute-force, scanning, and exfiltration attacks mapped to MITRE ATT&CK, validated in a live Splunk instance.
A SIEM-based Fintech Threat Monitoring project using Splunk Enterprise to investigate suspicious transactions, phishing indicators, transaction structuring, malicious IP activity and threat hunting through interactive dashboards and SPL queries
Detection engineering lab: MITRE ATT&CK detections built and validated on real telemetry across Splunk (RBA) and Microsoft Sentinel (KQL), with writeups.
Add a description, image, and links to the spl-queries topic page so that developers can more easily learn about it.
To associate your repository with the spl-queries topic, visit your repo's landing page and select "manage topics."