35 write-ups on SIEM engineering, Splunk, detection content and incident response — from the SOC floor, not the vendor deck.
A step-by-step guide to collecting detailed, single-line AIX security logs (logins, su, sudo, executed commands, process activity, cron and binary logs) in /var/log/messages and shipping them to Splunk with the Universal Forwarder, including sample output, Splunk searches and the performance impact.
A step-by-step guide to setting up Ansible: install it, configure passwordless SSH, build an inventory and ansible.cfg, run ad-hoc commands, and upgrade Splunk Forwarders across all your servers with one playbook.
This guide installs a Dashboard Studio page that puts the daily Splunk health checks on one screen. The page covers platform health, indexing and ingestion, license, search and scheduler, infrastructure, clustering, errors and security, and search head cluster bundle replication.
Facing duplicate GUID issue in Splunk forwarders after cloning a VM? Learn how to regenerate the GUID using clone-prep-clear-config and a self-disabling one-shot app, with simple steps for Linux, AIX and Windows.
Every precedence and processing order in Splunk on one page: global vs app/user directory precedence, indexer cluster peer-apps, props.conf stanza priority, the index-time pipeline (SEDCMD before TRANSFORMS before RULESET), the search-time sequence (EXTRACT → REPORT → KV_MODE → FIELDALIAS → EVAL → LOOKUP → eventtypes → tags), which tier reads each setting, and the btool commands to prove it.
Splunk sidecars explained in simple terms: what they are, how the supervisor manages them, common issues like security alerts, and tips for Splunk admins.
A hands-on walkthrough of five Splunk detection use cases mapped to the OWASP Top 10 for LLM Applications 2025, with working SPL, tuning notes and the mistakes I made along the way.
Microsoft Exchange is often a primary target for business email compromise (BEC) and lateral movement. Getting deep visibility into what happens…
I recently set up the AI Assistant for Splunk on version 10.2 and wanted to share the full setup journey, including the parts nobody talks about (the…
Incorporating best practices like using splunk btool, splunk diag, and monitoring internal logs can significantly improve your ability to…
The Splunk CLI commands are listed here. Please leave a remark if you would like to add any additional commands or make any changes to the ones that…
The NTLM protocol has a long history in Windows environments and has served as a foundational authentication method for many years. However, its…
The Kerberos authentication protocol offers a robust and reliable solution to ensure secure access to network resources.
LDAP is a crucial component of modern IT infrastructure because it simplifies data management, enhances security, and facilitates the efficient…
Active Directory is the backbone of many modern IT infrastructures, offering a powerful set of tools for managing network resources efficiently and…
SSH port forwarding, also known as SSH tunneling, is a technique that enables the forwarding of network connections from one computer to another…
Data Loss Prevention (DLP) systems play a crucial role in safeguarding sensitive information within organizations. They are designed to prevent data…
Organizations are constantly seeking efficient ways to analyze the incidents. Splunk, a leading data analysis platform, offers a powerful search…
Chat GPT can be a valuable tool in a Security Operation Center (SOC) for various tasks. Chat GPT can be used as a training tool for SOC analysts…
In recent years, drones have become increasingly popular, finding applications in various industries such as photography, agriculture, delivery…
Forensic audio analysis involves the scientific examination of audio recordings to determine their authenticity, integrity, and the events that led…
In today's digital age where online privacy and security have become paramount concerns, virtual private networks (VPNs) have gained significant…
SPF, DKIM, and DMARC are three important email authentication protocols that help protect against email fraud and abuse. In this post, we'll dive…
There are so many different kinds of password attacks. We must comprehend the various attack types in order to recognize and prevent these attacks.
SIEM (Security Information and Event Management) provides a comprehensive view of events and incidents by collecting logs from routers to end points…
Ransomware attacks have been occurring for many years, but have become more prevalent in recent times. Some notable ransomware attacks include:
Onion Services (Search Engines) on the darknet.
I pressed ChatGPT about its ability to defend us against attackers, and it gave me an intriguing answer.
An application provides direct access to an object, such as a file or a database record, based on user-supplied input. This can allow an attacker to…
[command: !mona jmp -r esp -m "file name"]
Protecting Endpoints are challenging. It has become more crucial after the COVID pandemic. Work from Home has made Cybersecurity more proactive from…
If we know how to hack, we can protect us from being hacked. In this Hacking Tutorial, we will see the basics of hacking. But don't try this in…
Organizations running with more than 1000 employees, need to have big infrastructure. Organizations running with more than 100,000 employees need to…
As we all know, the year 2020 falls out of ordinary circumstances. This is because many organizations were in a situation to adapt to new environment…
Cyber Attacks, you started hearing these words on a daily basis in news and social media. Protecting yourself and your organization from…
No article matches that. Try a shorter word.