Blue Team 5 commands
Splunk
Platform for searching, monitoring, and analyzing machine-generated data. Industry leader in SIEM and security analytics.
siemmonitoringlog-analysisdetection
Installation
# Download from splunk.com
# Splunk Free available for up to 500MB/day
# Docker: docker run -d -p 8000:8000 splunk/splunkCommands & usage
5 entriesindex=main sourcetype=syslogSearch syslog events
| stats count by src_ipCount events by source IP
| where status>=400Filter error responses
| timechart count by actionTime-based visualization
| table _time, src_ip, dest_ip, actionCreate result table
Use cases
SIEM operationsLog analysisThreat detectionIncident investigationSecurity monitoring