“Must-Know SPL Queries for Rapid Incident Response in Splunk”
1 min read
Summary
Fortunately for cybersecurity professionals, many signs of potential security incidents can be found in a organisation’s logs, and Splunk’s Search Processing Language (SPL) helps you read these logs specifically.
The fast response to a burgeoning security incident requires quick and efficient queries to identify anomalies and recognise threats, and five particular SPL queries stand out as being especially useful for security professionals.
An indication of a brute-force attack is “Find Failed Login Attempts”, which helps to identify and correlate failed login logs from particular source IPs.
“Detect Multiple Logins from Different Locations” helps recognise possible account takeovers by identifying users who log in from various places within a short period.
“Find Newly Created Admin Accounts” helps to detect if an attacker has created unauthorised admin accounts for themselves, whilst “Detect Large Data Transfers” can identify potential data leaks by spotting unusual data flow activity.
“Create Custom Threat Intelligence with Jasper” creates a list of suspicious or malicious IP addresses, domains, or file hashes and continuously analyses logs to find matches, thereby giving a proactive tool for threat detection.