[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESWCFMNCRGSPSBXCZ8N5A4":3,"skill-same:01M6ESWCFMNCRGSPSBXCZ8N5A4":123},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6ESWCFMNCRGSPSBXCZ8N5A4","building-detection-rule-with-splunk-spl",null,"Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"with","rule","splunk","SPL","detection","building detection rule with splunk spl","enterprise-security","processing","de","conversion","cm","analysis","cybersecurity","correlation-search","detection-engineering","T1059.001","threat-detection","soc","search","siem","2026-11-10 10:12:30",false,"---\nname: building-detection-rule-with-splunk-spl\ndescription: Build effective detection rules using Splunk Search Processing Language\n  (SPL) correlation searches to identify security threats in SOC environments.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- splunk\n- spl\n- detection-engineering\n- correlation-search\n- siem\n- soc\n- threat-detection\n- enterprise-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1059.001\n- T1003.001\n- T1021.002\n- T1110.003\n- T1053.005\n- T1048\n---\n\n# Building Detection Rules with Splunk SPL\n\n## Overview\n\nSplunk Search Processing Language (SPL) is the primary query language used in Splunk Enterprise Security for building correlation searches that detect suspicious events and patterns. A well-crafted detection rule aggregates, correlates, and enriches security events to generate actionable notable events for SOC analysts. Enterprise SIEMs on average cover only 21% of MITRE ATT&CK techniques, making skilled SPL rule writing essential for closing detection gaps.\n\n\n## When to Use\n\n- When deploying or configuring building detection rule with splunk spl capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Splunk Enterprise Security (ES) deployed and configured\n- Access to Splunk Search & Reporting app with appropriate roles\n- Understanding of Common Information Model (CIM) data models\n- Familiarity with MITRE ATT&CK framework techniques\n- Knowledge of the organization's log sources and data flows\n\n## Core SPL Detection Rule Patterns\n\n### 1. Threshold-Based Detection\n\nDetects events exceeding a defined count within a time window.\n\n```spl\nindex=wineventlog sourcetype=WinEventLog:Security EventCode=4625\n| stats count as failed_logins dc(TargetUserName) as unique_users by src_ip\n| where failed_logins > 10 AND unique_users > 3\n| eval severity=\"high\"\n| eval description=\"Brute force attack detected from \".src_ip.\" with \".failed_logins.\" failed logins across \".unique_users.\" accounts\"\n```\n\n### 2. Sequence-Based Detection (Failed Login Followed by Success)\n\nCorrelates a sequence of events indicating a successful brute force attack.\n\n```spl\nindex=wineventlog sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624)\n| eval login_status=case(EventCode=4625, \"failure\", EventCode=4624, \"success\")\n| stats count(eval(login_status=\"failure\")) as failures count(eval(login_status=\"success\")) as successes latest(_time) as last_event by src_ip, TargetUserName\n| where failures > 5 AND successes > 0\n| eval description=\"Account \".TargetUserName.\" compromised via brute force from \".src_ip\n| eval urgency=\"critical\"\n```\n\n### 3. Anomaly Detection with Baseline Comparison\n\nCompares current activity against a baseline period to detect spikes.\n\n```spl\nindex=proxy sourcetype=squid\n| bin _time span=1h\n| stats count as current_count by src_ip, _time\n| join src_ip type=left [\n    search index=proxy sourcetype=squid earliest=-7d@d latest=-1d@d\n    | stats avg(count) as avg_count stdev(count) as stdev_count by src_ip\n]\n| eval threshold=avg_count + (3 * stdev_count)\n| where current_count > threshold\n| eval deviation=round((current_count - avg_count) \u002F stdev_count, 2)\n| eval description=\"Anomalous web traffic from \".src_ip.\" - \".deviation.\" standard deviations above baseline\"\n```\n\n### 4. Lateral Movement Detection\n\nIdentifies potential lateral movement using Windows logon events.\n\n```spl\nindex=wineventlog sourcetype=WinEventLog:Security EventCode=4624 Logon_Type=3\n| where NOT match(TargetUserName, \".*\\$$\")\n| stats dc(dest) as unique_hosts values(dest) as hosts by src_ip, TargetUserName\n| where unique_hosts > 5\n| eval severity=case(unique_hosts > 20, \"critical\", unique_hosts > 10, \"high\", true(), \"medium\")\n| eval description=TargetUserName.\" accessed \".unique_hosts.\" unique hosts from \".src_ip.\" via network logon\"\n```\n\n### 5. Data Exfiltration Detection\n\nMonitors for large outbound data transfers.\n\n```spl\nindex=firewall sourcetype=pan:traffic action=allowed direction=outbound\n| stats sum(bytes_out) as total_bytes_out dc(dest_ip) as unique_destinations by src_ip, user\n| eval total_mb=round(total_bytes_out\u002F1048576, 2)\n| where total_mb > 500 OR unique_destinations > 50\n| lookup asset_lookup ip as src_ip OUTPUT asset_category, asset_owner\n| eval severity=case(total_mb > 2000, \"critical\", total_mb > 1000, \"high\", true(), \"medium\")\n| eval description=user.\" transferred \".total_mb.\"MB to \".unique_destinations.\" unique destinations\"\n```\n\n### 6. PowerShell Suspicious Execution Detection\n\nDetects encoded or obfuscated PowerShell commands.\n\n```spl\nindex=wineventlog sourcetype=WinEventLog:Security EventCode=4104\n| where match(ScriptBlockText, \"(?i)(encodedcommand|invoke-expression|iex|downloadstring|frombase64string|net\\.webclient|invoke-webrequest|bitstransfer|invoke-mimikatz|invoke-shellcode)\")\n| eval decoded_length=len(ScriptBlockText)\n| stats count values(ScriptBlockText) as commands by Computer, UserName\n| where count > 0\n| eval severity=\"high\"\n| eval mitre_technique=\"T1059.001\"\n| eval description=\"Suspicious PowerShell execution on \".Computer.\" by \".UserName\n```\n\n## Building Correlation Searches in Splunk ES\n\n### Step-by-Step Process\n\n1. **Define the Use Case**: Map to MITRE ATT&CK technique and define what behavior to detect\n2. **Identify Data Sources**: Determine which indexes and sourcetypes contain relevant events\n3. **Write the Base Search**: Build SPL that extracts relevant events\n4. **Add Aggregation**: Use `stats`, `eventstats`, or `streamstats` to summarize\n5. **Apply Thresholds**: Set conditions with `where` clause that distinguish normal from anomalous\n6. **Enrich Context**: Add lookups for asset information, identity data, and threat intelligence\n7. **Configure Notable Event**: Set severity, urgency, and description fields\n8. **Schedule and Test**: Run against historical data and validate detection accuracy\n\n### Correlation Search Configuration Template\n\n```spl\n| tstats summariesonly=true count from datamodel=Authentication\n    where Authentication.action=failure\n    by Authentication.src, Authentication.user, _time span=5m\n| rename \"Authentication.*\" as *\n| stats count as total_failures dc(user) as unique_users values(user) as targeted_users by src\n| where total_failures > 20 AND unique_users > 5\n| lookup dnslookup clientip as src OUTPUT clienthost as src_dns\n| lookup asset_lookup ip as src OUTPUT priority as asset_priority, category as asset_category\n| eval urgency=case(asset_priority==\"critical\", \"critical\", asset_priority==\"high\", \"high\", true(), \"medium\")\n| eval rule_name=\"Brute Force Against Multiple Accounts\"\n| eval rule_description=\"Multiple authentication failures from \".src.\" targeting \".unique_users.\" unique accounts\"\n| eval mitre_attack=\"T1110.001 - Password Guessing\"\n```\n\n### Enrichment Best Practices\n\n```spl\n| lookup identity_lookup identity as user OUTPUT department, manager, risk_score as user_risk\n| lookup asset_lookup ip as src_ip OUTPUT asset_name, asset_category, asset_priority, asset_owner\n| lookup threatintel_lookup ip as src_ip OUTPUT threat_type, threat_confidence, threat_source\n| eval context=case(\n    isnotnull(threat_type), \"Known threat: \".threat_type,\n    user_risk > 80, \"High-risk user: risk score \".user_risk,\n    asset_priority==\"critical\", \"Critical asset: \".asset_name,\n    true(), \"Standard context\"\n)\n```\n\n## Performance Optimization\n\n### Use Data Models with tstats\n\n```spl\n| tstats summariesonly=true count from datamodel=Network_Traffic\n    where All_Traffic.action=allowed\n    by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port, _time span=1h\n| rename \"All_Traffic.*\" as *\n```\n\n### Limit Time Ranges and Use Indexed Fields\n\n```spl\nindex=wineventlog source=\"WinEventLog:Security\" EventCode=4688\n    earliest=-15m latest=now()\n| where NOT match(New_Process_Name, \"(?i)(svchost|csrss|lsass|services)\")\n```\n\n### Use Summary Indexing for Historical Baselines\n\n```spl\n| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src, _time span=1h\n| collect index=summary source=\"auth_failure_baseline\" marker=\"report_name=auth_failure_hourly\"\n```\n\n## Testing and Validation\n\n### Test Against Known Attack Patterns\n\n```spl\n| makeresults count=1\n| eval src_ip=\"10.0.0.50\", failed_logins=25, unique_users=8, severity=\"high\"\n| eval description=\"Test brute force detection\"\n| append [\n    search index=wineventlog sourcetype=WinEventLog:Security EventCode=4625\n    earliest=-24h latest=now()\n    | stats count as failed_logins dc(TargetUserName) as unique_users by src_ip\n    | where failed_logins > 10 AND unique_users > 3\n    | eval severity=\"high\"\n]\n```\n\n### Calculate Detection Metrics\n\n```spl\nindex=notable\n| search rule_name=\"Brute Force*\"\n| stats count as total_alerts count(eval(status_label=\"Closed - True Positive\")) as true_positives count(eval(status_label=\"Closed - False Positive\")) as false_positives by rule_name\n| eval precision=round(true_positives \u002F (true_positives + false_positives) * 100, 2)\n| eval fpr=round(false_positives \u002F total_alerts * 100, 2)\n```\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Technique Name | SPL Detection Approach |\n|---|---|---|\n| T1110.001 | Password Guessing | Threshold on EventCode 4625 by src_ip |\n| T1059.001 | PowerShell | Pattern match on EventCode 4104 ScriptBlockText |\n| T1021.002 | SMB\u002FWindows Admin Shares | Logon Type 3 with dc(dest) threshold |\n| T1048 | Exfiltration Over C2 | bytes_out aggregation over time window |\n| T1053.005 | Scheduled Task | EventCode 4698 with suspicious command patterns |\n| T1003.001 | LSASS Memory | Process access to lsass.exe via Sysmon EventCode 10 |\n\n## References\n\n- [Splunk ES Correlation Searches Best Practices](https:\u002F\u002Fdetect.fyi\u002Fsplunk-es-correlation-searches-rules-best-cool-practices-06ef94884170)\n- [Writing Practical Splunk Detection Rules](https:\u002F\u002Fmedium.com\u002F@vitbukac\u002Fpractical-splunk-detection-rules-how-to-part-1-crawl-a24bc39a4b9d)\n- [Configure Correlation Searches - Splunk Documentation](https:\u002F\u002Fhelp.splunk.com\u002Fen\u002Fsplunk-enterprise-security-8\u002Fsplunk-app-for-pci-compliance\u002Finstallation-and-configuration-manual\u002F6.1\u002Fconfigure-correlation-searches\u002Fconfigure-correlation-searches)\n- [SOC Prime - Correlation Events in Splunk](https:\u002F\u002Fsocprime.com\u002Fblog\u002Fcreating-correlation-events-in-splunk-using-alerts\u002F)\n","# Building Detection Rules with Splunk SPL\n\n## Overview\n\nSplunk Search Processing Language (SPL) is the primary query language used in Splunk Enterprise Security for building correlation searches that detect suspicious events and patterns. A well-crafted detection rule aggregates, correlates, and enriches security events to generate actionable notable events for SOC analysts. Enterprise SIEMs on average cover only 21% of MITRE ATT&CK techniques, making skilled SPL rule writing essential for closing detection gaps.\n\n\n## When to Use\n\n- When deploying or configuring building detection rule with splunk spl capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Splunk Enterprise Security (ES) deployed and configured\n- Access to Splunk Search & Reporting app with appropriate roles\n- Understanding of Common Information Model (CIM) data models\n- Familiarity with MITRE ATT&CK framework techniques\n- Knowledge of the organization's log sources and data flows\n\n## Core SPL Detection Rule Patterns\n\n### 1. Threshold-Based Detection\n\nDetects events exceeding a defined count within a time window.\n\n```spl\nindex=wineventlog sourcetype=WinEventLog:Security EventCode=4625\n| stats count as failed_logins dc(TargetUserName) as unique_users by src_ip\n| where failed_logins > 10 AND unique_users > 3\n| eval severity=\"high\"\n| eval description=\"Brute force attack detected from \".src_ip.\" with \".failed_logins.\" failed logins across \".unique_users.\" accounts\"\n```\n\n### 2. Sequence-Based Detection (Failed Login Followed by Success)\n\nCorrelates a sequence of events indicating a successful brute force attack.\n\n```spl\nindex=wineventlog sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624)\n| eval login_status=case(EventCode=4625, \"failure\", EventCode=4624, \"success\")\n| stats count(eval(login_status=\"failure\")) as failures count(eval(login_status=\"success\")) as successes latest(_time) as last_event by src_ip, TargetUserName\n| where failures > 5 AND successes > 0\n| eval description=\"Account \".TargetUserName.\" compromised via brute force from \".src_ip\n| eval urgency=\"critical\"\n```\n\n### 3. Anomaly Detection with Baseline Comparison\n\nCompares current activity against a baseline period to detect spikes.\n\n```spl\nindex=proxy sourcetype=squid\n| bin _time span=1h\n| stats count as current_count by src_ip, _time\n| join src_ip type=left [\n    search index=proxy sourcetype=squid earliest=-7d@d latest=-1d@d\n    | stats avg(count) as avg_count stdev(count) as stdev_count by src_ip\n]\n| eval threshold=avg_count + (3 * stdev_count)\n| where current_count > threshold\n| eval deviation=round((current_count - avg_count) \u002F stdev_count, 2)\n| eval description=\"Anomalous web traffic from \".src_ip.\" - \".deviation.\" standard deviations above baseline\"\n```\n\n### 4. Lateral Movement Detection\n\nIdentifies potential lateral movement using Windows logon events.\n\n```spl\nindex=wineventlog sourcetype=WinEventLog:Security EventCode=4624 Logon_Type=3\n| where NOT match(TargetUserName, \".*\\$$\")\n| stats dc(dest) as unique_hosts values(dest) as hosts by src_ip, TargetUserName\n| where unique_hosts > 5\n| eval severity=case(unique_hosts > 20, \"critical\", unique_hosts > 10, \"high\", true(), \"medium\")\n| eval description=TargetUserName.\" accessed \".unique_hosts.\" unique hosts from \".src_ip.\" via network logon\"\n```\n\n### 5. Data Exfiltration Detection\n\nMonitors for large outbound data transfers.\n\n```spl\nindex=firewall sourcetype=pan:traffic action=allowed direction=outbound\n| stats sum(bytes_out) as total_bytes_out dc(dest_ip) as unique_destinations by src_ip, user\n| eval total_mb=round(total_bytes_out\u002F1048576, 2)\n| where total_mb > 500 OR unique_destinations > 50\n| lookup asset_lookup ip as src_ip OUTPUT asset_category, asset_owner\n| eval severity=case(total_mb > 2000, \"critical\", total_mb > 1000, \"high\", true(), \"medium\")\n| eval description=user.\" transferred \".total_mb.\"MB to \".unique_destinations.\" unique destinations\"\n```\n\n### 6. PowerShell Suspicious Execution Detection\n\nDetects encoded or obfuscated PowerShell commands.\n\n```spl\nindex=wineventlog sourcetype=WinEventLog:Security EventCode=4104\n| where match(ScriptBlockText, \"(?i)(encodedcommand|invoke-expression|iex|downloadstring|frombase64string|net\\.webclient|invoke-webrequest|bitstransfer|invoke-mimikatz|invoke-shellcode)\")\n| eval decoded_length=len(ScriptBlockText)\n| stats count values(ScriptBlockText) as commands by Computer, UserName\n| where count > 0\n| eval severity=\"high\"\n| eval mitre_technique=\"T1059.001\"\n| eval description=\"Suspicious PowerShell execution on \".Computer.\" by \".UserName\n```\n\n## Building Correlation Searches in Splunk ES\n\n### Step-by-Step Process\n\n1. **Define the Use Case**: Map to MITRE ATT&CK technique and define what behavior to detect\n2. **Identify Data Sources**: Determine which indexes and sourcetypes contain relevant events\n3. **Write the Base Search**: Build SPL that extracts relevant events\n4. **Add Aggregation**: Use `stats`, `eventstats`, or `streamstats` to summarize\n5. **Apply Thresholds**: Set conditions with `where` clause that distinguish normal from anomalous\n6. **Enrich Context**: Add lookups for asset information, identity data, and threat intelligence\n7. **Configure Notable Event**: Set severity, urgency, and description fields\n8. **Schedule and Test**: Run against historical data and validate detection accuracy\n\n### Correlation Search Configuration Template\n\n```spl\n| tstats summariesonly=true count from datamodel=Authentication\n    where Authentication.action=failure\n    by Authentication.src, Authentication.user, _time span=5m\n| rename \"Authentication.*\" as *\n| stats count as total_failures dc(user) as unique_users values(user) as targeted_users by src\n| where total_failures > 20 AND unique_users > 5\n| lookup dnslookup clientip as src OUTPUT clienthost as src_dns\n| lookup asset_lookup ip as src OUTPUT priority as asset_priority, category as asset_category\n| eval urgency=case(asset_priority==\"critical\", \"critical\", asset_priority==\"high\", \"high\", true(), \"medium\")\n| eval rule_name=\"Brute Force Against Multiple Accounts\"\n| eval rule_description=\"Multiple authentication failures from \".src.\" targeting \".unique_users.\" unique accounts\"\n| eval mitre_attack=\"T1110.001 - Password Guessing\"\n```\n\n### Enrichment Best Practices\n\n```spl\n| lookup identity_lookup identity as user OUTPUT department, manager, risk_score as user_risk\n| lookup asset_lookup ip as src_ip OUTPUT asset_name, asset_category, asset_priority, asset_owner\n| lookup threatintel_lookup ip as src_ip OUTPUT threat_type, threat_confidence, threat_source\n| eval context=case(\n    isnotnull(threat_type), \"Known threat: \".threat_type,\n    user_risk > 80, \"High-risk user: risk score \".user_risk,\n    asset_priority==\"critical\", \"Critical asset: \".asset_name,\n    true(), \"Standard context\"\n)\n```\n\n## Performance Optimization\n\n### Use Data Models with tstats\n\n```spl\n| tstats summariesonly=true count from datamodel=Network_Traffic\n    where All_Traffic.action=allowed\n    by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port, _time span=1h\n| rename \"All_Traffic.*\" as *\n```\n\n### Limit Time Ranges and Use Indexed Fields\n\n```spl\nindex=wineventlog source=\"WinEventLog:Security\" EventCode=4688\n    earliest=-15m latest=now()\n| where NOT match(New_Process_Name, \"(?i)(svchost|csrss|lsass|services)\")\n```\n\n### Use Summary Indexing for Historical Baselines\n\n```spl\n| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src, _time span=1h\n| collect index=summary source=\"auth_failure_baseline\" marker=\"report_name=auth_failure_hourly\"\n```\n\n## Testing and Validation\n\n### Test Against Known Attack Patterns\n\n```spl\n| makeresults count=1\n| eval src_ip=\"10.0.0.50\", failed_logins=25, unique_users=8, severity=\"high\"\n| eval description=\"Test brute force detection\"\n| append [\n    search index=wineventlog sourcetype=WinEventLog:Security EventCode=4625\n    earliest=-24h latest=now()\n    | stats count as failed_logins dc(TargetUserName) as unique_users by src_ip\n    | where failed_logins > 10 AND unique_users > 3\n    | eval severity=\"high\"\n]\n```\n\n### Calculate Detection Metrics\n\n```spl\nindex=notable\n| search rule_name=\"Brute Force*\"\n| stats count as total_alerts count(eval(status_label=\"Closed - True Positive\")) as true_positives count(eval(status_label=\"Closed - False Positive\")) as false_positives by rule_name\n| eval precision=round(true_positives \u002F (true_positives + false_positives) * 100, 2)\n| eval fpr=round(false_positives \u002F total_alerts * 100, 2)\n```\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Technique Name | SPL Detection Approach |\n|---|---|---|\n| T1110.001 | Password Guessing | Threshold on EventCode 4625 by src_ip |\n| T1059.001 | PowerShell | Pattern match on EventCode 4104 ScriptBlockText |\n| T1021.002 | SMB\u002FWindows Admin Shares | Logon Type 3 with dc(dest) threshold |\n| T1048 | Exfiltration Over C2 | bytes_out aggregation over time window |\n| T1053.005 | Scheduled Task | EventCode 4698 with suspicious command patterns |\n| T1003.001 | LSASS Memory | Process access to lsass.exe via Sysmon EventCode 10 |\n\n## References\n\n- [Splunk ES Correlation Searches Best Practices](https:\u002F\u002Fdetect.fyi\u002Fsplunk-es-correlation-searches-rules-best-cool-practices-06ef94884170)\n- [Writing Practical Splunk Detection Rules](https:\u002F\u002Fmedium.com\u002F@vitbukac\u002Fpractical-splunk-detection-rules-how-to-part-1-crawl-a24bc39a4b9d)\n- [Configure Correlation Searches - Splunk Documentation](https:\u002F\u002Fhelp.splunk.com\u002Fen\u002Fsplunk-enterprise-security-8\u002Fsplunk-app-for-pci-compliance\u002Finstallation-and-configuration-manual\u002F6.1\u002Fconfigure-correlation-searches\u002Fconfigure-correlation-searches)\n- [SOC Prime - Correlation Events in Splunk](https:\u002F\u002Fsocprime.com\u002Fblog\u002Fcreating-correlation-events-in-splunk-using-alerts\u002F)\n",{"name":5,"tags":44,"author":46,"domain":31,"license":15,"version":47,"nist_csf":48,"subdomain":53,"description":7,"mitre_attack":54,"d3fend_techniques":60},[21,45,33,32,38,36,35,25],"spl","mahipal","1.0",[49,50,51,52],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[34,55,56,57,58,59],"T1003.001","T1021.002","T1110.003","T1053.005","T1048",[61,62,63,64,65],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill building-detection-rule-with-splunk-spl",{"tool":80,"command":81},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill building-detection-rule-with-splunk-spl",{"tool":83,"command":84},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill building-detection-rule-with-splunk-spl","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002FSKILL.md",true,[88,94,99,105,109,113,119],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ftemplate.md","ASSET","资产文件",1982,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002Fassets\u002Ftemplate.md",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",1554,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fstandards.md",2366,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002Freferences\u002Fstandards.md",{"path":110,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fworkflows.md",2069,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002Freferences\u002Fworkflows.md",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fagent.py","SCRIPT","脚本",6128,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002Fscripts\u002Fagent.py",{"path":120,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fprocess.py",14541,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fbuilding-detection-rule-with-splunk-spl\u002Fscripts\u002Fprocess.py",[124,166,175,184,206,233],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":147,"publishedAt":39},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[131,136,139,142],{"categoryNo":132,"categoryName":133,"taxonomyType":134,"taxonomyTypeDesc":135},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",{"categoryNo":137,"categoryName":138,"taxonomyType":134,"taxonomyTypeDesc":135},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":140,"categoryName":141,"taxonomyType":134,"taxonomyTypeDesc":135},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[126,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,19],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube",{"skillNo":167,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":174,"publishedAt":39},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[170,171,172,173],{"categoryNo":132,"categoryName":133,"taxonomyType":134,"taxonomyTypeDesc":135},{"categoryNo":137,"categoryName":138,"taxonomyType":134,"taxonomyTypeDesc":135},{"categoryNo":140,"categoryName":141,"taxonomyType":134,"taxonomyTypeDesc":135},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[126,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,19],{"skillNo":176,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":39},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[179,180,181,182],{"categoryNo":132,"categoryName":133,"taxonomyType":134,"taxonomyTypeDesc":135},{"categoryNo":137,"categoryName":138,"taxonomyType":134,"taxonomyTypeDesc":135},{"categoryNo":140,"categoryName":141,"taxonomyType":134,"taxonomyTypeDesc":135},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[126,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,19],{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":39},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[191,192,193,194,195,196,197,198,199,200,201,202,203,204,205],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":215,"publishedAt":39},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[212],{"categoryNo":213,"categoryName":214,"taxonomyType":134,"taxonomyTypeDesc":135},"01JBSEEDCAT000000000000023","Skill与智能体开发",[216,217,218,219,220,221,30,222,223,224,225,159,160,226,227,228,229,230,231,232],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":249,"publishedAt":39},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[239,242,245,246],{"categoryNo":240,"categoryName":241,"taxonomyType":134,"taxonomyTypeDesc":135},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":243,"categoryName":244,"taxonomyType":134,"taxonomyTypeDesc":135},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":213,"categoryName":214,"taxonomyType":134,"taxonomyTypeDesc":135},{"categoryNo":247,"categoryName":248,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000036","内容创作者",[250,251,252,253,254,255,256,257,156,258,159,160,161,259,260,261,262,263,205,264],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]