Security Blogs
Security
3 Min Read
Announcing the availability of Cisco Talos Incident Response services to Splunk customers.
Latest Articles
Old School vs. New School
The Splunk SURGe team examines the claim that generative AI will empower threat actors to improve the scale and/or efficiency of their spear-phishing campaigns.
Deploy, Test, Monitor: Mastering Microsoft Defender ASR with Atomic Techniques in Splunk
Explore Microsoft Defender ASR's role in cybersecurity with Splunk and learn deployment, testing, and monitoring strategies for robust defense.
Updated Baseline Creation and Dashboards in OT Security Add-on for Splunk Version 2.3
Version 2.3 of the OT Security Add-on for Splunk is here and it delivers three main updates.
SOC Models: In-House, Out-Sourced, or Hybrid SOC?
Splunk's Kirsty Paine shares best practices from a roundtable held at Gartner Security & Risk Management Summit 2023.
Reduce Operational Complexity with Splunk SOAR Logic Loops
Learn about the logic loops feature introduced in Splunk SOAR version 6.2 and how you can implement them in your own use cases and playbooks.
Laying the Foundation for a Resilient Modern SOC
Splunk Security supports your journey to digital resilience by providing comprehensive security visibility to reduce business risk; equipping your team with risk-based threat detection, investigation, and response technologies to help you build a modern SOC; and fueling security innovation through Splunk’s vibrant community.
Unmasking the Enigma: A Historical Dive into the World of PlugX Malware
The Splunk Threat Research Team (STRT) unravels the mystery of a PlugX variant, peeling back the layers of its payload, tactics, and impact on the digital realm.
User Behavior Monitoring with M-21-31
OMB M-21-31 requires US Federal Civilian agencies to implement user behavior monitoring. We'll explain what that means and how to do it right.
Detecting Dubious Domains with Levenshtein, Shannon & URL Toolbox
Got some parsed fields that you're ready to analyze... possibly for threat hunting? We'll use Levenshtein, Shannon & URL Toolbox to show you how!
Take a SIP: A Refreshing Look at Subject Interface Packages
Splunker Michael Haag dives into Subject Interface Packages (SIPs) and their role in Windows security, exploring how SIPs can be exploited by malicious actors to bypass security measures and sign malicious code.
Parsing Domains with URL Toolbox (Just Like House Slytherin)
One of the most popular Splunk security apps of all time, URL Toolbox’s URL parsing capabilities have been leveraged by thousands. Full story here.
CIO Roundtable: Harnessing GenAI for Resilient Security and Observability – Insights and Strategies
Get insights from a recent roundtable discussion in collaboration with CIO magazine. The talk focused on the dual challenge faced by IT and security managers: mitigating risks associated with AI while leveraging AI to enhance organizational capability.
Splunk SOAR 6.2 Introduces New Automation Features, Workload Migration, and Firewall Integrations
Announcing the release of Splunk SOAR 6.2 with features like logic loops for playbooks, integrations with CyberArk, two new firewall apps, and a new conversion option for classic playbooks.
Staff Picks for Splunk Security Reading November 2023
Splunk security experts share their list of presentations, whitepapers, and customer case studies from November 2023 that they feel are worth a read.
Using eval to Calculate, Appraise, Classify, Estimate & Threat Hunt
This article discusses a foundational capability within Splunk — the eval command. Need to pick a couple commands for your desert island collection? eval should be one!
Using RegEx for Threat Hunting (It’s Not Gibberish, We Promise!)
Another excellent tool for your threat hunting: RegEx! SPL offers two commands for utilizing regular expressions in Splunk searches. See how to do it here.
Stat! 3 Must-Have Data Filtering Techniques
To hunt for threats, there's a lot of data you do NOT need. Here are the 3 must-have data filtering techniques so you can hunt those threats STAT!
Compliance Essentials for Splunk 2.1.0
Announcing the latest on Compliance Essentials for Splunk, an essential part of your toolkit to help your organization maintain and monitor your compliance status and cyber resiliency with various frameworks.
Subscribe to our blog
Get the latest articles from Splunk straight to your inbox.
Connect with Splunk on X
Follow @Splunk
Connect with Splunk on Instagram
Follow @Splunk
