Security Blogs
Security
3 Min Read
Announcing the availability of Cisco Talos Incident Response services to Splunk customers.
Latest Articles
Staff Picks for Splunk Security Reading September 2023
Our Splunk security experts curated their September 2023 list of presentations, whitepapers, and customer case studies that we feel are worth a read.
See More, Act Faster, and Simplify Investigations with Customizable Workflows from Splunk Enterprise Security 7.2
Introducing new capabilities that deliver an improved workflow experience for simplified investigations; enhanced visibility and reduced manual workload; and customized investigation workflows for faster decision-making.
Revisiting the Big Picture: Macro-level ATT&CK Updates for 2023
SURGe reviews the latest attacker trends and behaviors with this look at four years of ATT&CK data from some of the largest and most trusted threat reporting sources.
Defending the Gates: Understanding and Detecting Ave Maria (Warzone) RAT
The Splunk Threat Research Team provides a deep-dive analysis of Ave Maria RAT, also known as 'Warzone RAT.'
Mockbin and the Art of Deception: Tracing Adversaries, Going Headless and Mocking APIs
Splunk's Threat Research Team delves into the attack's components, usage of tools like Mockbin and headless browsers, and provides guidance on detecting such activities.
Using stats, eventstats & streamstats for Threat Hunting…Stat!
The stats command is a crucial capability when you’re threat hunting. And so are two related commands: eventstats & streamstats. Get all the details, right here.
Using metadata & tstats for Threat Hunting
Behold the power of metadata and tstats commands! These commands will quickly provide situational awareness of your hosts and sourcetypes as you begin hunting.
Threat Hunting for Dictionary-DGA with PEAK
Explore applied model-assisted threat hunting for dictionary-based domain generation algorithms using the SURGe Security Research Team's PEAK Threat Hunting Framework.
Deep Learning in Security: Text-based Phishing Email Detection with BERT Model
We introduced a large language model (LLM)-based phishing email detector integrated into the Splunk DSDL app. We provide details on model training and evaluation, comparisons to other machine learning and deep learning algorithms as well as deployment approaches to Splunk in this blog.
Sharing is Not Caring: Hunting for Network Share Discovery
This post offers a practical guide to enhancing detection strategies against network share discovery, a technique often used by threat actors.
Staff Picks for Splunk Security Reading August 2023
Splunk security experts share a list of presentations, whitepapers, and customer case studies from August 2023 that they feel are worth a read.
Key Threat Hunting Deliverables with PEAK
When most people think of threat hunting, they think of uncovering unknown threats – but that is only one of many (better) reasons to show value with threat hunting.
Unified Strategies Across IT and Security for Cutting-Edge Detection, Investigation and Response
Splunk's Mike Horn shares a closer look at the value of a unified approach to security and observability.
Detecting Lateral Movement Using Splunk User Behavior Analytics
The blog is to introduce lateral movement detection using Splunk User Behavior Analytics (UBA)
Integrated Intelligence Enrichment With Threat Intelligence Management
Threat Intelligence Management enables analysts to fully investigate security events or suspicious activity by providing the relevant and normalized intelligence to better understand threat context and accelerate time to triage.
Using Splunk Stream for Hunting: Finding Islands in the Stream (of Data)
Let's look at how to use the popular Splunk Stream App for our favorite purpose: threat hunting! This is part of our Threat Hunting with Splunk series.
Splunk SOAR Playbook of the Month: Investigations with Playbooks
For this month’s edition of Playbook of the Month, we’ll look at how you can perform investigations at machine speed using Splunk SOAR and one of our investigation playbooks, Internal Host WinRM Investigate.
Subscribe to our blog
Get the latest articles from Splunk straight to your inbox.
Connect with Splunk on X
Follow @Splunk
Connect with Splunk on Instagram
Follow @Splunk
