THREAT OPS › Threat News › Spelunking through Splunk
Spelunking through Splunk
<p class="wp-block-paragraph"><strong><em>TL;DR</em></strong> : <em>Splunk is a daunting SIEM to learn, but this learning curve can be flattened by learning to use the basic building blocks which make up most Splunk searches.</em></p>
<h2 class="wp-block-heading" id="h-a-detection-engineer-s-guide">A Detection Engineer’s Guide</h2>
<p class="wp-block-paragraph">When I first got my start in c
MITRE ATT&CK techniques
- Password GuessingT1110.001
- JavaScriptT1059.007
- Data ManipulationT1565
- Generative AIAML.T0016.002
Indicators of compromise
- https://help.splunk.com/en/splunk-enterprise/administer/manage-workloadsurl
- https://help.splunk.com/en/data-management/manage-splunk-enterprise-indexers/10.2/indexing-overview/how-indexing-worksurl
- https://docs.splunk.com/Splexicon:Sourcetypeurl
- https://docs.splunk.com/Splexicon:Bloomfilterurl
- https://help.splunk.com/en/splunk-enterprise/search/search-manual/9.3/subsearches/about-subsearchesurl
- https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.3/search-commands/inputlookupurl
- https://help.splunk.com/en/splunk-enterprise/spl-search-reference/9.3/search-commands/fieldsurl
- https://help.splunk.com/en/splunk-enterprise/search/search-manual/9.4/subsearches/about-subsearches#Output-settings-for-subsearch-commandsurl
- https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.4/search-commands/statsurl
- https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.2/search-commands/stats#4.-remove-duplicates-in-the-result-set-and-return-the-total-count-for-the-unique-results-0url
- https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/subsearches/about-subsearches#ariaid-title4url
- https://docs.splunk.com/Documentation/Splunk/8.2.12/SearchReference/Transactionurl
- https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.3/search-commands/evalurl
- https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-reference/evaluation-functions/comparison-and-conditional-functions#ariaid-title5url
- https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.2/search-commands/rexurl
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_groupurl
- https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-manual/dates-and-time/time-modifiersurl
- https://help.splunk.com/en/splunk-enterprise/spl-search-reference/9.4/search-commands/convert#convert-functions-0url
- https://help.splunk.com/en/splunk-enterprise/spl-search-reference/9.1/search-commands/stats#1.-return-the-average-transfer-rate-for-each-host-0url
- https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.4/search-commands/stats#2.-search-the-access-logs-and-return-the-total-number-of-hits-from-the-top-100-values-of-referer_domain-0url
- 54.91.188.71ipv4
Original source: https://specterops.io/blog/2026/05/27/spelunking-through-splunk/