Threat Hunting with Data Science and Splunk for Beginners

Install Splunk Enterprise on Ubuntu by downloading the Debian package, transferring it to Linux, installing with dpkg, starting Splunk, and opening the web interface on port 8000 with admin credentials.

Learn to install multiple Splunk apps and add-ons by downloading from splunkbase.splunk.com, extracting .tgz files, transferring to /opt/splunk/etc/apps with FileZilla, and restarting Splunk to view installed apps.

Learn to access and import the bots datasets into Splunk, including versions one through three and their attack datasets, after installing the necessary add-ons.

Import lab attack logs into Splunk by installing Sysmon and Windows add-ons, uploading Sysmon and security logs, and validating data with a search in the main index.

Use mathematics and statistics to identify outliers in Splunk's massive logs, distinguishing normal from abnormal activity and guiding searches toward potential attacks.

Compute the mean and standard deviation in Splunk to define upper and lower bounds, then identify outliers versus normal data for threat hunting with data science.

Explore how the bell-shaped normal distribution (Gaussian) appears in data, and why Splunk users should combine methods beyond standard deviation to avoid false positives.

Learn the empirical rule, or 68–95–99.7 rule, to identify normal data and outliers using standard deviations, and apply it to reduce noisy logs in threat hunting with data science.

Convert different units to the standard normal distribution, or z-score, to unify charts and improve outlier detection across metrics.

Utilize data science with Splunk to hunt user access anomalies by identifying login outliers among successful logins (eventcode 4624) through time binning, stats, and outlier evaluation across hosts.

Detect ICMP tunnel activity with data science and Splunk by analyzing ICMP packet counts, computing the average and two standard deviations, and flagging outliers beyond lower and upper bounds.

Detect SMB traffic anomalies with Splunk by computing SMB connection standard deviation, identifying outliers using 7 standard deviations bounds, and displaying results for ports 139 and 445.

Discover how to detect malicious Windows process command lines with data science and Splunk. Identify outliers by calculating command line length, average, and standard deviation, using upper and lower bounds.

Detect log disruption attacks by monitoring index volume and outliers in Splunk using standard deviation, eventstats, and eval to flag anomalous log activity.

Learn to detect network traffic volume outliers with Splunk by analyzing destination IP addresses, applying binning and stats to compute bounds and z-scores, and flagging outliers.

Combine cpu, network, and memory data into a common metric, compute z-scores to detect anomalies, and visualize them in splunk to spot potential malware activity.

Learn to use Splunk to detect attacks by finding outliers with the punct field, standard deviation, and z-scores, and investigate suspicious logs.

Learn to use Shannon entropy to measure data randomness and detect suspicious process names and domains with Splunk, using the URL Toolbox app to calculate and analyze entropy.

Explore the Splunk machine learning toolkit (mltk), a free add-on for real-time analytics that provides clustering, regression, classification, and anomaly detection, plus data prep, model evaluation, and deployment.

Install the Splunk machine learning toolkit (MLTK) from Splunkbase, upload and install the app, then install the OS-specific addon via the command line to access tutorials.

Detect dns tunneling with the Splunk machine learning toolkit by analyzing dns packet bytes, calculating total bytes per src–dest IP, and flagging outliers with two standard deviations.

Increase fault tolerance and accuracy in data science with Splunk by applying streamstats, windowing, and standard deviation to detect outliers in DNS and ICMP traffic.

Explore how domain generation algorithms let malware and botnets evade firewalls by generating multiple domains for command and control, and how to use Splunk to detect DGA activity.

Install the dga app for Splunk by installing prerequisites such as Splunk Machine Learning Toolkit and URL Toolbox, then configure the dga app, create dga_proxy index, and enable alerts.

Detect DGAs using Splunk by exploring the DGA app dashboards, classifying domains by subclass, and visualizing legit versus generated domains with text mining and the URL toolbox app data.

Learn to detect cyber-attacks with NLP text analytics in Splunk by installing the NLP Text Analytics app and Python for Scientific Computing, then analyze text and clusters.