domains / families / security / analyzing-security-logs-with-splunk

analyzing-security-logs-with-splunk

separate

'Leverages Splunk Enterprise Security and SPL (Search Processing Language)

When to use

• Investigating a security incident that requires correlation across multiple log sources
• Hunting for adversary activity using known TTPs and IOCs
• Building detection rules for specific attack patterns
• Reconstructing an incident timeline from disparate log sources
• Analyzing authentication anomalies, lateral movement, or data exfiltration patterns

When not to use

• real-time packet-level analysis
• full packet capture analysis

Skill page

Source