Analyzing Security Logs With Splunk
Leverages Splunk Enterprise Security and SPL (Search Processing Language) to...
Install
npx skills add AgentFlocks/flocks --skill analyzing-security-logs-with-splunk -g -a claude-code -y- Repository
- AgentFlocks/flocks504
- Category
- Security
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 2,242 tokens
- Runs scripts
- Yes, review before use
What it does
Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.
Analyzing Security Logs with Splunk
When to Use
- Investigating a security incident that requires correlation across multiple log sources
- Hunting for adversary activity using known TTPs and IOCs
- Building detection rules for specific attack patterns
- Reconstructing an incident timeline from disparate log sources
- Analyzing authentication anomalies, lateral movement, or data exfiltration patterns
Do not use for real-time packet-level analysis; use Wireshark or Zeek for full packet capture analysis.
Prerequisites
- Splunk Enterprise or Splunk Cloud with Enterprise Security (ES) app installed
- Log sources ingested: Windows Event Logs (via Splunk Universal Forwarder or WEF), firewall, proxy, DNS, EDR, email gateway
- Splunk CIM (Common Information Model) data models configured for normalized field names
- SPL proficiency at intermediate level or higher
- Role-based access with
searchandaccelerate_searchcapabilities in Splunk
Workflow
Step 1: Scope the Investigation in Splunk
Define search parameters based on incident triage data:
| Set initial investigation scope
index=windows OR index=firewall OR index=proxy
earliest="2025-11-14T00:00:00" latest="2025-11-16T00:00:00"
(host="WKSTN-042" OR src_ip="10.1.5.42" OR user="jsmith")
| stats count by index, sourcetype, host
| sort -count
This query establishes which log sources contain relevant data for the investigation timeframe and affected assets.
Step 2: Analyze Authentication Events
Investigate suspicious authentication patterns using Windows Security Event Logs:
| Detect brute force and credential stuffing
index=windows sourcetype="WinEventLog:Security" EventCode=4625
earliest=-24h
| stats count as failed_attempts, values(src_ip) as source_ips,
dc(src_ip) as unique_sources by TargetUserName
| where failed_attempts > 10
| sort -failed_attempts
