Introduction

When I started this project, my instinct — like most people learning detection engineering — was to think about correlation first. It felt…

TL;DR Splunk released patches on July 15, 2026 for three Splunk Enterprise vulnerabilities. The most serious, CVE-2026-20296, is a cross-site request forgery (CSRF) flaw that enables SPL execution…

Being “internal” doesn’t mean being safe.

A hands-on look at deploying Splunk Enterprise, writing SPL detection rules, launching real attacks from Kali Linux, and hunting the…

In this walkthrough, I am investigating the BOTS v3 dataset provided by Splunk on TryHackMe. The goal is to analyze real-world attack…

As part of my journey toward becoming a SOC Analyst, I recently completed the Log Analysis with SIEM room on TryHackMe.

Room: Splunk: Setting up a SOC Lab Path: SOC Level 2, Section 2: Advanced Splunk Difficulty: Intermediate Time: 60 minutes Prerequisites…

TryHackMe Walkthrough: Splunk — Exploring SPL (Step-by-Step with Q&A) Room: Splunk: Exploring SPL Path: SOC Level 2 → Section 2: Advanced Splunk Difficulty: Intermediate | Time: ~60 min …

Same drill as ItsyBitsy, different SIEM this time — Splunk instead of Kibana, and a compromised HR host to untangle. Let’s get into the…

Following up on the SOC Lab setup room, this next challenge in the SOC Level 2 path moves past the basics of getting Splunk running and…

Setting up SafeLine WAF was the easy part. You spin up the Docker containers, route your traffic, and watch it start eating malicious…

This room picks up where the earlier Splunk challenges left off. Instead of focusing on searching or visualizing data that is already…

Exploring the Search Processing Language [SPL] that runs in Splunk’s “Search Heads”

This room shifts focus from Splunk over to the Elastic Stack, specifically Logstash, the data processing engine that sits between raw logs…

Fixit, A TryHackMe Walkthrough

A practical reference for common SPL queries, commands, and operators.