--- name: building-detection-rule-with-splunk-spl-af017017bc4b description: Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments. domain: cybersecurity subdomain: soc-operations tags: - splunk - spl - detection-engineering - correlation-search - siem - soc - threat-detection - enterprise-security version: '1.0' author: Krishna Kumar (xalgord) license: Apache-2.0 d3fend_techniques: - Executable Denylisting - Execution Isolation - File Metadata Consistency Validation - Content Format Conversion - File Content Analysis nist_csf: - DE.CM-01 - DE.AE-02 - RS.MA-01 - DE.AE-06 --- # Building Detection Rules with Splunk SPL ## Overview Splunk Search Processing Language (SPL) is the primary query language used in Splunk Enterprise Security for building correlation searches that detect suspicious events and patterns. A well-crafted detection rule aggregates, correlates, and enriches security events to generate actionable notable events for SOC analysts. Enterprise SIEMs on average cover only 21% of MITRE ATT&CK techniques, making skilled SPL rule writing essential for closing detection gaps. ## When to Use - When deploying or configuring building detection rule with splunk spl capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation ## Prerequisites - Splunk Enterprise Security (ES) deployed and configured - Access to Splunk Search & Reporting app with appropriate roles - Understanding of Common Information Model (CIM) data models - Familiarity with MITRE ATT&CK framework techniques - Knowledge of the organization's log sources and data flows ## Core SPL Detection Rule Patterns ### 1. Threshold-Based Detection Detects events exceeding a defined count within a time window. ```spl index=wineventlog sourcetype=WinEventLog:Security EventCode=4625 | stats count as failed_logins dc(TargetUserName) as unique_users by src_ip | where failed_logins > 10 AND unique_users > 3 | eval severity="high" | eval description="Brute force attack detected from ".src_ip." with ".failed_logins." failed logins across ".unique_users." accounts" ``` ### 2. Sequence-Based Detection (Failed Login Followed by Success) Correlates a sequence of events indicating a successful brute force attack. ```spl index=wineventlog sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | eval login_status=case(EventCode=4625, "failure", EventCode=4624, "success") | stats count(eval(login_status="failure")) as failures count(eval(login_status="success")) as successes latest(_time) as last_event by src_ip, TargetUserName | where failures > 5 AND successes > 0 | eval description="Account ".TargetUserName." compromised via brute force from ".src_ip | eval urgency="critical" ``` ### 3. Anomaly Detection with Baseline Comparison Compares current activity against a baseline period to detect spikes. ```spl index=proxy sourcetype=squid | bin _time span=1h | stats count as current_count by src_ip, _time | join src_ip type=left [ search index=proxy sourcetype=squid earliest=-7d@d latest=-1d@d | stats avg(count) as avg_count stdev(count) as stdev_count by src_ip ] | eval threshold=avg_count + (3 * stdev_count) | where current_count > threshold | eval deviation=round((current_count - avg_count) / stdev_count, 2) | eval description="Anomalous web traffic from ".src_ip." - ".deviation." standard deviations above baseline" ``` ### 4. Lateral Movement Detection Identifies potential lateral movement using Windows logon events. ```spl index=wineventlog sourcetype=WinEventLog:Security EventCode=4624 Logon_Type=3 | where NOT match(TargetUserName, ".*\$$") | stats dc(dest) as unique_hosts values(dest) as hosts by src_ip, TargetUserName | where unique_hosts > 5 | eval severity=case(unique_hosts > 20, "critical", unique_hosts > 10, "high", true(), "medium") | eval description=TargetUserName." accessed ".unique_hosts." unique hosts from ".src_ip." via network logon" ``` ### 5. Data Exfiltration Detection Monitors for large outbound data transfers. ```spl index=firewall sourcetype=pan:traffic action=allowed direction=outbound | stats sum(bytes_out) as total_bytes_out dc(dest_ip) as unique_destinations by src_ip, user | eval total_mb=round(total_bytes_out/1048576, 2) | where total_mb > 500 OR unique_destinations > 50 | lookup asset_lookup ip as src_ip OUTPUT asset_category, asset_owner | eval severity=case(total_mb > 2000, "critical", total_mb > 1000, "high", true(), "medium") | eval description=user." transferred ".total_mb."MB to ".unique_destinations." unique destinations" ``` ### 6. PowerShell Suspicious Execution Detection Detects encoded or obfuscated PowerShell commands. ```spl index=wineventlog sourcetype=WinEventLog:Security EventCode=4104 | where match(ScriptBlockText, "(?i)(encodedcommand|invoke-expression|iex|downloadstring|frombase64string|net\.webclient|invoke-webrequest|bitstransfer|invoke-mimikatz|invoke-shellcode)") | eval decoded_length=len(ScriptBlockText) | stats count values(ScriptBlockText) as commands by Computer, UserName | where count > 0 | eval severity="high" | eval mitre_technique="T1059.001" | eval description="Suspicious PowerShell execution on ".Computer." by ".UserName ``` ## Building Correlation Searches in Splunk ES ### Step-by-Step Process 1. **Define the Use Case**: Map to MITRE ATT&CK technique and define what behavior to detect 2. **Identify Data Sources**: Determine which indexes and sourcetypes contain relevant events 3. **Write the Base Search**: Build SPL that extracts relevant events 4. **Add Aggregation**: Use `stats`, `eventstats`, or `streamstats` to summarize 5. **Apply Thresholds**: Set conditions with `where` clause that distinguish normal from anomalous 6. **Enrich Context**: Add lookups for asset information, identity data, and threat intelligence 7. **Configure Notable Event**: Set severity, urgency, and description fields 8. **Schedule and Test**: Run against historical data and validate detection accuracy ### Correlation Search Configuration Template ```spl | tstats summariesonly=true count from datamodel=Authentication where Authentication.action=failure by Authentication.src, Authentication.user, _time span=5m | rename "Authentication.*" as * | stats count as total_failures dc(user) as unique_users values(user) as targeted_users by src | where total_failures > 20 AND unique_users > 5 | lookup dnslookup clientip as src OUTPUT clienthost as src_dns | lookup asset_lookup ip as src OUTPUT priority as asset_priority, category as asset_category | eval urgency=case(asset_priority=="critical", "critical", asset_priority=="high", "high", true(), "medium") | eval rule_name="Brute Force Against Multiple Accounts" | eval rule_description="Multiple authentication failures from ".src." targeting ".unique_users." unique accounts" | eval mitre_attack="T1110.001 - Password Guessing" ``` ### Enrichment Best Practices ```spl | lookup identity_lookup identity as user OUTPUT department, manager, risk_score as user_risk | lookup asset_lookup ip as src_ip OUTPUT asset_name, asset_category, asset_priority, asset_owner | lookup threatintel_lookup ip as src_ip OUTPUT threat_type, threat_confidence, threat_source | eval context=case( isnotnull(threat_type), "Known threat: ".threat_type, user_risk > 80, "High-risk user: risk score ".user_risk, asset_priority=="critical", "Critical asset: ".asset_name, true(), "Standard context" ) ``` ## Performance Optimization ### Use Data Models with tstats ```spl | tstats summariesonly=true count from datamodel=Network_Traffic where All_Traffic.action=allowed by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port, _time span=1h | rename "All_Traffic.*" as * ``` ### Limit Time Ranges and Use Indexed Fields ```spl index=wineventlog source="WinEventLog:Security" EventCode=4688 earliest=-15m latest=now() | where NOT match(New_Process_Name, "(?i)(svchost|csrss|lsass|services)") ``` ### Use Summary Indexing for Historical Baselines ```spl | tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src, _time span=1h | collect index=summary source="auth_failure_baseline" marker="report_name=auth_failure_hourly" ``` ## Testing and Validation ### Test Against Known Attack Patterns ```spl | makeresults count=1 | eval src_ip="10.0.0.50", failed_logins=25, unique_users=8, severity="high" | eval description="Test brute force detection" | append [ search index=wineventlog sourcetype=WinEventLog:Security EventCode=4625 earliest=-24h latest=now() | stats count as failed_logins dc(TargetUserName) as unique_users by src_ip | where failed_logins > 10 AND unique_users > 3 | eval severity="high" ] ``` ### Calculate Detection Metrics ```spl index=notable | search rule_name="Brute Force*" | stats count as total_alerts count(eval(status_label="Closed - True Positive")) as true_positives count(eval(status_label="Closed - False Positive")) as false_positives by rule_name | eval precision=round(true_positives / (true_positives + false_positives) * 100, 2) | eval fpr=round(false_positives / total_alerts * 100, 2) ``` ## MITRE ATT&CK Mapping | Technique ID | Technique Name | SPL Detection Approach | |---|---|---| | T1110.001 | Password Guessing | Threshold on EventCode 4625 by src_ip | | T1059.001 | PowerShell | Pattern match on EventCode 4104 ScriptBlockText | | T1021.002 | SMB/Windows Admin Shares | Logon Type 3 with dc(dest) threshold | | T1048 | Exfiltration Over C2 | bytes_out aggregation over time window | | T1053.005 | Scheduled Task | EventCode 4698 with suspicious command patterns | | T1003.001 | LSASS Memory | Process access to lsass.exe via Sysmon EventCode 10 | ## References - [Splunk ES Correlation Searches Best Practices](https://detect.fyi/splunk-es-correlation-searches-rules-best-cool-practices-06ef94884170) - [Writing Practical Splunk Detection Rules](https://medium.com/@vitbukac/practical-splunk-detection-rules-how-to-part-1-crawl-a24bc39a4b9d) - [Configure Correlation Searches - Splunk Documentation](https://help.splunk.com/en/splunk-enterprise-security-8/splunk-app-for-pci-compliance/installation-and-configuration-manual/6.1/configure-correlation-searches/configure-correlation-searches) - [SOC Prime - Correlation Events in Splunk](https://socprime.com/blog/creating-correlation-events-in-splunk-using-alerts/) --- Source attribution: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/soc-operations/building-detection-rule-with-splunk-spl/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2026 xalgord Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/soc-operations/building-detection-rule-with-splunk-spl/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering, Operations Roles: Business Process Analyst, Data Analyst, ML / AI Engineer, Operations Manager, Security Engineer Specialties: API Tools: Splunk Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 45a810dff2ac2109005c6dbe0738134b10c2ecccbfbafd4a3037b57485098a6b