๐จโ๐ป๐ฅ[๐๐ฉ๐ฅ๐ฎ๐ง๐ค ๐๐๐๐ ๐๐จ๐ฆ๐ ๐๐๐]๐ฅ๐ฉโ๐ป
This is the most powerful home-lab focused on setting up Splunk SIEM and real-world use cases.
If youโre interested in becoming a SOC Analyst(Tier 1/2), this lab will help you with SOC tools, rules, queries, apps, and integration.
๐ข ๐๐ฅ๐๐ญ๐๐จ๐ซ๐ฆ ๐๐ง๐ ๐๐
๐ Download Virtualbox https://www.virtualbox.org/wiki/Downloads
๐ Download Windows Server 2019 [FREE TRIAL 180 days] https://info.microsoft.com/ww-landing-windows-server-2019.html
๐ข ๐๐๐ญ ๐ฎ๐ฉ ๐๐ฉ๐ฅ๐ฎ๐ง๐ค ๐๐๐๐
๐ Download Splunk Enterprise [FREE TRIAL 60 days] https://www.splunk.com/en_us/download/splunk-enterprise.html
๐ Download Splunk Security Essentials App [FREE] https://splunkbase.splunk.com/app/3435
๐ข ๐๐๐ฆ๐ฉ๐ฅ๐ ๐๐๐๐ฎ๐ซ๐ข๐ญ๐ฒ ๐๐๐ญ๐๐ฌ๐๐ญ
๐ BOTS V2 Dataset [16.4 GB]. https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set_attack_only.tgz
๐ BOTS V2 Dataset(Attack Only) [3.2 GB] https://s3.amazonaws.com/botsdataset/botsv2/botsv2_data_set.tgz
๐ข Top 20 Use Cases
You can go through the list of Splunk queries, detection rules and playbook here: https://research.splunk.com/detections/
Iโve mentioned top 20 Detection rules below:
โญ ๐๐ฎ๐ฅ๐ญ๐ข๐ฉ๐ฅ๐ ๐
๐๐ข๐ฅ๐๐ ๐๐จ๐ ๐ข๐ง๐ฌ: Detect multiple failed login attempts within a short time frame from a single source IP.
โญ๐๐ง๐ฎ๐ฌ๐ฎ๐๐ฅ ๐๐๐๐จ๐ฎ๐ง๐ญ ๐๐๐ญ๐ข๐ฏ๐ข๐ญ๐ฒ: Monitor for unusual activities, such as excessive failed logins or multiple password changes within a short time for a specific user.
โญ๐๐ซ๐ฎ๐ญ๐ ๐
๐จ๐ซ๐๐ ๐๐ญ๐ญ๐๐๐ค: Look for repeated login failures across multiple accounts within a specific time window.
โญ๐๐ซ๐ข๐ฏ๐ข๐ฅ๐๐ ๐๐ ๐๐๐๐จ๐ฎ๐ง๐ญ ๐๐ฌ๐๐ ๐: Monitor privileged account logins and actions to identify any unauthorized or unusual activities.
โญ๐๐๐ฅ๐ฐ๐๐ซ๐ ๐๐ซ๐ญ๐ข๐๐๐๐ญ๐ฌ: Search for known malware file hashes, filenames, or command-and-control IP addresses.
โญ๐๐ฎ๐ญ๐๐จ๐ฎ๐ง๐ ๐๐๐ญ๐ ๐๐ฑ๐๐ข๐ฅ๐ญ๐ซ๐๐ญ๐ข๐จ๐ง: Detect large data transfers to external destinations that may indicate data exfiltration.
โญ๐๐ง๐๐จ๐ฎ๐ง๐ ๐๐ฎ๐ฌ๐ฉ๐ข๐๐ข๐จ๐ฎ๐ฌ ๐๐ซ๐๐๐๐ข๐: Look for unexpected incoming traffic from suspicious IP addresses or geolocations.
โญ๐๐ง๐จ๐ฆ๐๐ฅ๐จ๐ฎ๐ฌ ๐๐๐ญ๐ฐ๐จ๐ซ๐ค ๐๐ซ๐๐๐๐ข๐: Identify unusual network traffic patterns, such as spikes or deviations from baseline.
โญ๐๐ฎ๐ฌ๐ฉ๐ข๐๐ข๐จ๐ฎ๐ฌ ๐๐ฌ๐๐ซ-๐๐ ๐๐ง๐ญ ๐๐ญ๐ซ๐ข๐ง๐ ๐ฌ: Identify potentially malicious user-agent strings used in web requests.
โญ๐๐๐ง๐ฌ๐จ๐ฆ๐ฐ๐๐ซ๐ ๐๐๐ญ๐ข๐ฏ๐ข๐ญ๐ฒ: Detect ransomware indicators like file renames with specific extensions or ransom notes.
๐ฌ๐ฌ COMMENT โ Found Useful? Share and Comment! ๐ฌ๐ฌ