Splunk Security Essentials -Master Splunk, SIEM & SOC Skills

In this section, we explore Splunk Apps and Splunkbase, showing how to extend Splunk’s capabilities with add-ons like CIM, Sysmon, Machine Learning Toolkit, Enterprise Security, FortiGate, and Tenable, while also learning the step-by-step process of downloading and installing apps from Splunkbase.

Splunk Security Essentials is a free Splunk app that helps you find security procedures that fit your environment, learn how they work, deploy them, and measure your success.

In this lesson, we introduce the Splunk InfoSec App, explain its purpose as a free security-focused application from Splunkbase, outline the prerequisites such as key data sources (firewall, Active Directory, antivirus logs) and supporting add-ons (CIM, Punchcard Visualization, Force Directed Visualization, Lookup File Editor, Sankey Diagram), and show how it helps analyze threats, detect anomalies, and improve security monitoring within Splunk.

Splunk Security Essentials offers default procedures for a variety of security use cases and for every stage of the security journey. The procedures provide a way to start ingesting your data into Splunk Enterprise and monitoring useful metrics within your environment.

In this lesson, we prepare Splunk for the InfoSec App by introducing and installing required add-ons—Splunk CIM for data standardization, Force Directed Visualization for mapping relationships, Lookup File Editor for easy list management, and noting that older visualizations like Punchcard and Sankey have been deprecated in favor of Dashboard Studio.

Splunk Security Essentials uses time series searches to detect spikes, first time seen searches to detect new values, and general Splunk searches

In this lesson, we install the supporting apps needed for the InfoSec App, including Splunk CIM for standardized data, Punchcard and Force Directed Visualization for better analysis, and the Lookup File Editor for easier management of lookup tables

Splunk Security Essentials is an app that can amplify the power of existing security technology investments to strengthen an organization’s security program — no matter their current level of maturity. The app provides an extensive library of pre-built security content that aligns with the MITRE ATT&CK framework and Cyber Kill Chain, making it easy to visualize your current security coverage and find and implement new content that addresses your organization’s needs — without having to create it from scratch. It also offers a prescriptive security maturity framework that helps you determine your current level of maturity and provides recommendations on additional data sources and security content to implement to reach the next level of maturity

In this lesson, we prepare Splunk for the InfoSec App by first setting up and accelerating key CIM data models (Authentication, Intrusion Detection, Network Traffic, Malware, Change, Endpoint, Web), then installing essential add-ons such as the Splunk Add-on for Microsoft Windows and Splunk Add-on for Sysmon, ensuring detailed log collection and standardized data for effective threat detection.

Splunk Security Essentials (SSE) provides out-of-the-box security use cases and actionable security content to begin addressing threats and assessing gaps quickly and efficiently. You can leverage the wide-ranging use case library to eliminate gaps in defensive posture, implement detections, and measure and justify new sources of data based on coverage of threats and risks to the business. Additionally, the deep integration with MITRE ATT&CK and Cyber Kill chain helps you configure Splunk Enterprise Security by pushing attributions to the Incident Review Dashboard, assess the level of coverage to ATT&CK tactics and techniques, and integrate risk-based events and alerting.

In this lesson, we install and configure the Splunk Add-on for Unix and Linux, set it up to monitor meaningful directories like /var/log, enable key scripted metric and event inputs (CPU, disk, network, processes, ports, users), create and assign the proper index, and adjust the inputs.conf file so Splunk can collect and tag Linux system logs and metrics effectively.

• Security content library

  • Browse, bookmark, and deploy over 900 security detections with a few clicks.

  • Find the right security content by filtering via use case, threat, data source, or cybersecurity framework.

  • Stay ahead of threats with content that pulls the latest detections from Splunk Threat Research Team.

• Cybersecurity frameworks

  • Automatically map your data to cybersecurity frameworks such as MITRE ATT&CK and Cyber Kill Chain.

  • Measure your business posture against the frameworks and easily identify gaps to strengthen your defenses.

  • Drill down on MITRE tactics, techniques, and threat groups to understand what detections are tied to different phases of the Kill Chain.

• Data and content introspection

  • Inspect and analyze data and security content already in your environment.

  • Gain a better understanding of your Splunk environment, as well as how your data is or can be Common Information Model (CIM) compliant.

  • Enrich your existing security content with tags and metadata such as threat and data source categories, MITRE ATT&CK notes, and more.

• Security Data Journey

  • Develop a maturity roadmap with security and data recommendations.

  • Track and measure your progress through the Security Data Journey.

  • Implement best practices and detections with the data you’re already collecting.

  • Prioritize ingestion of new data sources to increase coverage and reduce risks.

In this lesson, we explore the Splunk InfoSec App dashboards—starting with Security Posture—and learn how they visualize authentication logs, malware activity, firewall events, network traffic, anomalies, and brute-force attempts, making it easier for SOC analysts to detect, investigate, and respond to security incidents.

Splunk Security Essentials is an extensive security content library that provides detailed guidance on why and how to expand your security use case content in the Splunk platform, Splunk Enterprise Security, Splunk User Behavior Analytics, and Splunk SOAR environments. SSE uses standard search SPL combined with data prerequisites to help you determine if a use case has the right data in place to gain the most value from the content you are interested in.

In this section, we cover abnormal login attempts and brute force attacks—what they are, how they work, their different types (dictionary, credential stuffing, password spraying), and how to detect them through failed logins, suspicious IP behavior, time anomalies, and geolocation mismatches.

In this section, we explore the Splunk Security Essentials app, focusing on how it provides ready-to-use security use cases—like brute force detection—mapped to MITRE ATT&CK tactics and threat groups, with step-by-step queries, implementation guidance, and even SOAR playbook recommendations to help analysts detect, investigate, and respond effectively.

In this section, we dive into phishing attacks and user activity monitoring, focusing on how attackers exploit human behavior with deceptive emails or calls, and how correlation rules in Splunk help us detect anomalies like abnormal logins, unusual access times, or compromised accounts.

In this section, we focus on monitoring user and system activities, learning how to spot abnormal behaviors such as unusual login attempts, data access, or privilege escalation, and applying correlation rules and risk scoring to connect the dots and detect potential insider threats or compromised accounts.

In this lesson, we’ll explore SIEM’s role and advantages. A SIEM (Security Information and Event Management) system acts like the brain of security operations—it collects logs from across the organization, analyzes them, and connects events to spot suspicious activity in real-time. Splunk is one of the leading SIEM platforms, and when paired with security-focused apps like InfoSec App (which visualizes logs and highlights anomalies such as brute force attempts) and Splunk Security Essentials (which provides ready-made use cases mapped to MITRE ATT&CK), it becomes even more powerful. Together, these tools make detection faster, analysis clearer, and response smarter—helping organizations strengthen their defenses and reduce incident response time.

In this lesson, we’re going to introduce Search Processing Language (SPL), which is the backbone of Splunk. SPL is how we interact with data inside Splunk, helping us filter, analyze, and visualize logs quickly and effectively.

In this lecture, we focus on understanding SPL syntax, learning how Splunk’s Search Processing Language is structured and applied to transform raw logs into meaningful insights through commands, functions, and pipelines.

In this lesson, we introduce the basic Splunk search commands used to filter, display, and manage event data.

In this lesson, we continue exploring intermediate search commands that help refine, transform, and correlate log data.

In this lesson, we focus on advanced search commands that support statistical analysis and visualization in Splunk.

In this lesson, we cover expert-level search commands that optimize performance and enable complex investigations.

In this lesson, we explain Splunk functions that extend search commands with calculations, transformations, and data enrichment.

In this lecture, we explore Anomaly and Semantic Analysis Techniques, focusing on three core areas: User Behavior Analytics (UBA), Network Anomaly Detection, and Real-Time Event Detection Rules. UBA helps establish a baseline of what is “normal” user activity and flags deviations such as unusual login times or unexpected data access, making it highly effective against insider threats. Network anomaly detection, on the other hand, builds profiles of typical communication patterns between systems and identifies irregular behaviors—like abnormal traffic spikes or unauthorized external connections—that could indicate attacks such as ransomware or misconfigurations. Finally, real-time event detection rules allow security teams to monitor logs as they arrive and trigger immediate alerts for suspicious actions like repeated failed logins, abnormal file transfers, or unauthorized process executions. Together, these techniques enable organizations not only to detect anomalies early but also to respond swiftly, forming a proactive defense strategy in modern cybersecurity

Splunk Security Essentials (SSE) provides out-of-the-box security use cases and actionable security content to begin addressing threats and assessing gaps quickly and efficiently. You can leverage the wide-ranging use case library to eliminate gaps in defensive posture, implement detections, and measure and justify new sources of data based on coverage of threats and risks to the business. Additionally, the deep integration with MITRE ATT&CK and Cyber Kill chain helps you configure Splunk Enterprise Security by pushing attributions to the Incident Review Dashboard, assess the level of coverage to ATT&CK tactics and techniques, and integrate risk-based events and alerting.