Learn about attacks leveraging Exchange Online and how to detect them in a SOC.

Understanding How Logs Reach Your SIEM

Splunk is a cybersecurity and data monitoring tool that collects logs from different devices servers applications and network equipment It…

Conti An Exchange server was compromised with ransomware. Use Splunk to investigate how the attackers compromised the server. Un beau jour, des employés ont remarqué qu’ils ne peuvent plus …

Scenario: On Friday, September 15, 2023, Michael Ascot, a Senior Finance Director from SwiftSpend, was checking his emails in Outlook and…

Introduction

When I started this project, my instinct — like most people learning detection engineering — was to think about correlation first. It felt…

TL;DR Splunk released patches on July 15, 2026 for three Splunk Enterprise vulnerabilities. The most serious, CVE-2026-20296, is a cross-site request forgery (CSRF) flaw that enables SPL execution…

Being “internal” doesn’t mean being safe.

A hands-on look at deploying Splunk Enterprise, writing SPL detection rules, launching real attacks from Kali Linux, and hunting the…