Threat Hunting vs Threat Detection: What's The Difference?.

NEW: PEAK Threat Hunting Framework Series.

Threat Hunting: Everything To Know About Hunting Cyber Threats.Here's some brand new and forever-favorite resources, too, that are about threat hunting with or without Splunk: So, let's make it clear, this entire series is about using Splunk for your threat hunting activities.

Want to learn more about threat hunting in general? Keep reading for more information about hunting and the team behind this series, SURGe. That's why we're updating this series, one article at a time, verifying that each tutorial is the best resource for some aspect of hunting, all using Splunk. Today, we are doubling-down on our threat hunting capabilities. (Hint: it isn’t.) So, that’s why we started writing this series in 2017. Going back to at least a decade, we’ve tried to make it easy - as you’ll see in the resources below - and yet threat hunting is about as easy as telling someone how easy it is to draw an owl. Why, all you need to do is use X and Y with Splunk to find a Z score (no zombies were injured) and BOOM! That baddie in your network is detected. As you can see, the result shows the name of each file as well as the average bytes for each file.At Splunk, you may hear us pontificating on our ponies about how awesome and easy it is to use Splunk to hunt for threats. In the below example, we get the average size of bytes of each file present in the web_application log. When we want to get results grouped by some specific field or we want to rename a field in the output, we use the group by clause and the as clause respectively. In the below example, we use the Stats avg() function which calculates the average value of the numeric field being taken as input. FunctionsĪlong with commands, Splunk also provides many in-built functions which can take input from a field being analysed and give the output after applying the calculations on that field. In the below example we use the head command to filter out only the top 3 results from a search operation. You can use many in-built commands that SPL provides to simplify the process of analysing the data in the result set. In the below example, we are searching for records which contain two highlighted terms. These are the terms you mention in the search bar to get specific records from the dataset which meet the search criteria. Let us discuss all the components with the help of images in the below section − Search Terms Like Sum, Average etc.Ĭlauses − How to group or rename the fields in the result set. Search Terms − These are the keywords or phrases you are looking for.Ĭommands − The action you want to take on the result set like format the result or count them.įunctions − What are the computations you are going to apply on the results. This is achieved by learning the usage of SPL. For this, you need some additional commands to be added to the existing command. For example, when you get a result set for a search term, you may further want to filter some more specific terms from the result set. The Splunk Search Processing Language (SPL) is a language containing many commands, functions, arguments, etc., which are written to get the desired results from the datasets.

Splunk tutorial pdf cheat sheet