analyzing-security-logs-with-splunk

# Analyzing Security Logs with Splunk ## When to Use - Investigating a security incident that requires correlation across multiple log sources - Hunting for adversary activity using known TTPs and IOCs - Building detection rules for specific attack patterns - Reconstructing an incident timeline from disparate log sources - Analyzing authentication anomalies, lateral movement, or data exfiltration patterns **Do not use** for real-time packet-level analysis; use Wireshark or Zeek for full packet capture analysis. ## Prerequisites - Splunk Enterprise or Splunk Cloud with Enterprise Security (ES) app installed - Log sources ingested: Windows Event Logs (via Splunk Universal Forwarder or WEF), firewall, proxy, DNS, EDR, email gateway - Splunk CIM (Common Information Model) data models configured for normalized field names - SPL proficiency at intermediate level or higher - Role-based access with `search` and `accelerate_search` capabilities in Splunk ## Workflow ### Step 1: Scope the Investigation in Splunk Define search parameters based on incident triage data: ```spl | Set initial investigation scope index=windows OR index=firewall OR index=proxy earliest="2025-11-14T00:00:00" latest="2025-11-16T00:00:00" (host="WKSTN-042" OR src_ip="10.1.5.42" OR user="jsmith") | stats count by index, sourcetype, host | sort -count ``` This query establishes which log sources contain relevant data for the investigation timeframe and affected assets. ### Step 2: Analyze Authentica...