Skip to content
sourabh mane
All projects

project / 03SOC · SIEM

Splunk Alert Monitoring & Incident Response

SPL searches and an alert for brute-force logins and malware events, worked through the IR lifecycle.

View source updated
Stack
  • Splunk Cloud
  • SPL
  • Alerting
  • Incident Response

Overview

An internship task in Splunk Cloud. I built a sample security log dataset of failed and successful logins, brute-force attempts and malware detections, uploaded it, and wrote SPL to surface the patterns. The brute-force search became an alert, and the write-up follows the incident from detection through recovery.

Problem

A SOC lives on alerts that fire for the right reasons. The task was to take raw security events, find the brute-force and malware patterns in them, and turn that into an alert and a response plan.

Approach

Ingest a structured sample dataset into Splunk Cloud, write SPL searches for each pattern, save the brute-force search as an alert, and document the response.

Implementation

  • Created samplesplunklog.csv with failed logins, successful logins, brute-force attempts and malware detections, then uploaded it through Add Data → Upload File.
  • Wrote SPL searches for repeated failed logins and malware detections.
  • Saved the failed-login search as an alert: triggered when more than 5 failed logins come from the same IP within 10 minutes.
  • Documented the alert type trade-off (scheduled vs real-time), trigger conditions and actions (email to the SOC team, webhook, incident dashboard).

Detection logic

Failed logins from the same source (brute-force candidate) · spl
index=main action="login" status="failed"
| stats count by user, src_ip
| where count > 5
All malware detections · spl
index=main action="malware_detection"
| stats count by src_ip, signature, severity

Key features

  • Custom CSV dataset: logins, brute-force attempts, Trojan / worm / ransomware detections
  • SPL to find more than 5 failed logins per user and source IP
  • SPL to group malware detections by source, signature and severity
  • “Brute Force Login Alert” saved from SPL, with trigger conditions and actions
  • Incident response walk-through: detection → analysis → containment → eradication → recovery

Security concepts

  • Brute-force detection
  • Malware event triage
  • Alert tuning (scheduled vs real-time)
  • Incident response lifecycle

Notes

  • Data is synthetic and the environment is a Splunk Cloud free trial. The incident response steps describe the workflow as planned in the report, not a production incident.