Skip to content

Instantly share code, notes, and snippets.

View luis261's full-sized avatar

Luis luis261

  • Germany
View GitHub Profile
@luis261
luis261 / splunk_es_search_collection.md
Last active June 4, 2024 12:27
A handful of SPL snippets I've accumulated to help with analyses 🔬 in Splunk Enterprise Security. I tried to keep the assumptions a given search makes about the environment to a minimum to ensure general applicability.

Important

The 2/3 meta notable event searches below are mainly meant to prevent duplicate analyst work. If they come back without results for a given input, that doesn't mean the value you searched for is "clean", since it doesn't have associated events (e.g. when filtering for a hash/E-Mail address/company asset/external host/user etc). It just means that there aren't any investigation steps that you might consider skipping to avoid duplicated effort because there already exists an associated verdict history. There might still have been other, possibly malicious events in the notable index, that have not (yet) been reviewed/triaged for actual investigation by an analyst. Such events wouldn't show up here since we're filtering for output that is useful for our investigation by providing additional context via past analyst comments. Instead, no events showing up perhaps should be a flag for you to perform your investigation with extra diligence, since your working with an occurence not observed/anal