Splunk¶
SPL for incident response and threat hunting — syntax notes, reusable searches, hunting patterns and the BOTSv3 practice method. Every query here names its index and sourcetype; adapt them to your environment.
Question → page¶
| Question | Page |
|---|---|
| What does this command do? How do I write SPL? | SPL cheat sheet |
| What data is in this instance? Which fields? What time range? | Data discovery & time |
| The field I need doesn't exist / the XML isn't parsed | rex, field extraction & eval |
| Who logged on, what ran, how did they persist, did they move laterally? | Security searches by question |
| Nothing alerted — how do I find what's unusual? | Hunting patterns |
| How do I work through BOTSv3 (or any CTF dataset) properly? | BOTSv3 investigation workflow |
| Beaconing / C2 in Splunk | Beaconing & C2 (network section, streamstats walkthrough) |
| What does event ID 4xxx mean? | Windows Event IDs |
Pages¶
- SPL cheat sheet — search anatomy, filtering, 40 commands with examples, reusable patterns, speed rules
- Data discovery & time — indexes, sourcetypes,
fieldsummary, CIM names, time modifiers, log-gap detection - rex, fields & eval — regex extraction,
spath,evalfunctions, lookups, promoting to permanent extractions - Security searches — logons, execution, persistence, lateral movement, network, tampering, host timeline
- Hunting patterns — rare, new, spike, regular, long tail, peer outlier, sequences, drop-and-run, scoring
- BOTSv3 workflow — data map, pivot keys, investigation loop, first-look searches (no spoilers)
House rules for SPL in this handbook¶
Queries are written to be pasted: index= and sourcetype= always present; comments explain each clause below the block; Windows event codes are named the first time they appear; field names follow what the Splunk Windows/Sysmon add-ons produce (Account_Name, Logon_Type, Image, CommandLine) with the CIM equivalent noted where it matters.
Adding a page here
python new.py splunk/<name> -t concept (or -t playbook for a scenario write-up) — the file appears in the sidebar automatically.