Lab 24: The Attack Ran. The Alerts Fired.
In Lab 13, I ran a brute force attack and got zero alerts. In Lab 24, I ran the same attack in Splunk. 15 alerts fired in under 2 seconds. That's the difference between a detection gap and a detection
#splunk
Posts tagged #splunk
Lab 23: Writing My First Splunk Detection Rule
Lab 22 got Splunk running. 180 events indexed. 76 SSH brute force events confirmed in the index. The pipeline was alive. But a SIEM with no detection rules is still just a search engine. Lab 23 is whe
Lab 22: Same Logs, New SIEM — Setting Up Splunk From Scratch
Lab 21 closed the detection gap in Elastic. 31 alerts fired. End-to-end detection confirmed. The Elastic SIEM phase of the portfolio was complete. So naturally, I installed a second SIEM. Lab 22 is th
