Introduction

When I started this project, my instinct — like most people learning detection engineering — was to think about correlation first. It felt…

TL;DR Splunk released patches on July 15, 2026 for three Splunk Enterprise vulnerabilities. The most serious, CVE-2026-20296, is a cross-site request forgery (CSRF) flaw that enables SPL execution…

Being “internal” doesn’t mean being safe.

A hands-on look at deploying Splunk Enterprise, writing SPL detection rules, launching real attacks from Kali Linux, and hunting the…

In this walkthrough, I am investigating the BOTS v3 dataset provided by Splunk on TryHackMe. The goal is to analyze real-world attack…

As part of my journey toward becoming a SOC Analyst, I recently completed the Log Analysis with SIEM room on TryHackMe.

Room: Splunk: Setting up a SOC Lab Path: SOC Level 2, Section 2: Advanced Splunk Difficulty: Intermediate Time: 60 minutes Prerequisites…

TryHackMe Walkthrough: Splunk — Exploring SPL (Step-by-Step with Q&A) Room: Splunk: Exploring SPL Path: SOC Level 2 → Section 2: Advanced Splunk Difficulty: Intermediate | Time: ~60 min …

Same drill as ItsyBitsy, different SIEM this time — Splunk instead of Kibana, and a compromised HR host to untangle. Let’s get into the…