Field notes on SIEM, Splunk, detection engineering and security operations.https://vinishjustin.dev/https://vinishjustin.dev/blog/aix-security-logging-splunk/https://vinishjustin.dev/blog/aix-security-logging-splunk/A step-by-step guide to collecting detailed, single-line AIX security logs (logins, su, sudo, executed commands, process activity, cron and binary logs) in /var/log/messages and shipping them to Splunk with the Universal Forwarder, including sample output, Splunk searches and the performance impact.Mon, 26 Oct 2026 00:00:00 GMThttps://vinishjustin.dev/blog/ansible-managing-servers/https://vinishjustin.dev/blog/ansible-managing-servers/A step-by-step guide to setting up Ansible: install it, configure passwordless SSH, build an inventory and ansible.cfg, run ad-hoc commands, and upgrade Splunk Forwarders across all your servers with one playbook.Tue, 20 Oct 2026 00:00:00 GMThttps://vinishjustin.dev/blog/splunk-daily-health-dashboard-implementation-guide/https://vinishjustin.dev/blog/splunk-daily-health-dashboard-implementation-guide/This guide installs a Dashboard Studio page that puts the daily Splunk health checks on one screen. The page covers platform health, indexing and ingestion, license, search and scheduler, infrastructure, clustering, errors and security, and search head cluster bundle replication.Sat, 10 Oct 2026 00:00:00 GMThttps://vinishjustin.dev/blog/regenerate-splunk-uf-guid/https://vinishjustin.dev/blog/regenerate-splunk-uf-guid/Facing duplicate GUID issue in Splunk forwarders after cloning a VM? Learn how to regenerate the GUID using clone-prep-clear-config and a self-disabling one-shot app, with simple steps for Linux, AIX and Windows.Mon, 05 Oct 2026 00:00:00 GMThttps://vinishjustin.dev/blog/splunk-configuration-precedence-cheat-sheet/https://vinishjustin.dev/blog/splunk-configuration-precedence-cheat-sheet/Every precedence and processing order in Splunk on one page: global vs app/user directory precedence, indexer cluster peer-apps, props.conf stanza priority, the index-time pipeline (SEDCMD before TRANSFORMS before RULESET), the search-time sequence (EXTRACT → REPORT → KV_MODE → FIELDALIAS → EVAL → LOOKUP → eventtypes → tags), which tier reads each setting, and the btool commands to prove it.Tue, 29 Sep 2026 00:00:00 GMThttps://vinishjustin.dev/blog/splunk-sidecars-explained/https://vinishjustin.dev/blog/splunk-sidecars-explained/Splunk sidecars explained in simple terms: what they are, how the supervisor manages them, common issues like security alerts, and tips for Splunk admins.Wed, 23 Sep 2026 00:00:00 GMThttps://vinishjustin.dev/blog/detecting-genai-attacks-in-splunk/https://vinishjustin.dev/blog/detecting-genai-attacks-in-splunk/A hands-on walkthrough of five Splunk detection use cases mapped to the OWASP Top 10 for LLM Applications 2025, with working SPL, tuning notes and the mistakes I made along the way.Sun, 20 Sep 2026 00:00:00 GMThttps://vinishjustin.dev/blog/bridging-the-gap-integrating-microsoft-exchange-2022-with-splunk-for-advanced-security-auditing/https://vinishjustin.dev/blog/bridging-the-gap-integrating-microsoft-exchange-2022-with-splunk-for-advanced-security-auditing/Microsoft Exchange is often a primary target for business email compromise (BEC) and lateral movement. Getting deep visibility into what happens…Sat, 25 Apr 2026 00:00:00 GMThttps://vinishjustin.dev/blog/splunk-ai-assistant/https://vinishjustin.dev/blog/splunk-ai-assistant/I recently set up the AI Assistant for Splunk on version 10.2 and wanted to share the full setup journey, including the parts nobody talks about (the…Sat, 28 Feb 2026 00:00:00 GMThttps://vinishjustin.dev/blog/splunk-universal-forwarder-troubleshooting/https://vinishjustin.dev/blog/splunk-universal-forwarder-troubleshooting/Incorporating best practices like using splunk btool, splunk diag, and monitoring internal logs can significantly improve your ability to…Tue, 05 Nov 2024 00:00:00 GMThttps://vinishjustin.dev/blog/splunk-admin-cheat-sheet/https://vinishjustin.dev/blog/splunk-admin-cheat-sheet/The Splunk CLI commands are listed here. Please leave a remark if you would like to add any additional commands or make any changes to the ones that…Sat, 09 Mar 2024 00:00:00 GMThttps://vinishjustin.dev/blog/active-directory-series-iv/https://vinishjustin.dev/blog/active-directory-series-iv/The NTLM protocol has a long history in Windows environments and has served as a foundational authentication method for many years. However, its…Thu, 28 Sep 2023 00:00:00 GMThttps://vinishjustin.dev/blog/active-directory-series-iii/https://vinishjustin.dev/blog/active-directory-series-iii/The Kerberos authentication protocol offers a robust and reliable solution to ensure secure access to network resources.Mon, 25 Sep 2023 00:00:00 GMThttps://vinishjustin.dev/blog/active-directory-series-ii/https://vinishjustin.dev/blog/active-directory-series-ii/LDAP is a crucial component of modern IT infrastructure because it simplifies data management, enhances security, and facilitates the efficient…Fri, 22 Sep 2023 00:00:00 GMThttps://vinishjustin.dev/blog/active-directory-series/https://vinishjustin.dev/blog/active-directory-series/Active Directory is the backbone of many modern IT infrastructures, offering a powerful set of tools for managing network resources efficiently and…Thu, 21 Sep 2023 00:00:00 GMThttps://vinishjustin.dev/blog/access-the-inaccessible-ssh-port-forwarding/https://vinishjustin.dev/blog/access-the-inaccessible-ssh-port-forwarding/SSH port forwarding, also known as SSH tunneling, is a technique that enables the forwarding of network connections from one computer to another…Sun, 02 Jul 2023 00:00:00 GMThttps://vinishjustin.dev/blog/dlp-failures-and-lessons-learned/https://vinishjustin.dev/blog/dlp-failures-and-lessons-learned/Data Loss Prevention (DLP) systems play a crucial role in safeguarding sensitive information within organizations. They are designed to prevent data…Wed, 07 Jun 2023 00:00:00 GMThttps://vinishjustin.dev/blog/splunkcommands/https://vinishjustin.dev/blog/splunkcommands/Organizations are constantly seeking efficient ways to analyze the incidents. Splunk, a leading data analysis platform, offers a powerful search…Sun, 04 Jun 2023 00:00:00 GMThttps://vinishjustin.dev/blog/chat-gpt-and-soc-use-cases/https://vinishjustin.dev/blog/chat-gpt-and-soc-use-cases/Chat GPT can be a valuable tool in a Security Operation Center (SOC) for various tasks. Chat GPT can be used as a training tool for SOC analysts…Thu, 01 Jun 2023 00:00:00 GMThttps://vinishjustin.dev/blog/drone-security-safeguarding-the-skies/https://vinishjustin.dev/blog/drone-security-safeguarding-the-skies/In recent years, drones have become increasingly popular, finding applications in various industries such as photography, agriculture, delivery…Wed, 31 May 2023 00:00:00 GMThttps://vinishjustin.dev/blog/how-is-audio-forensic-carried-out/https://vinishjustin.dev/blog/how-is-audio-forensic-carried-out/Forensic audio analysis involves the scientific examination of audio recordings to determine their authenticity, integrity, and the events that led…Fri, 28 Apr 2023 00:00:00 GMThttps://vinishjustin.dev/blog/unlocking-the-power-of-privacy-vpn/https://vinishjustin.dev/blog/unlocking-the-power-of-privacy-vpn/In today's digital age where online privacy and security have become paramount concerns, virtual private networks (VPNs) have gained significant…Tue, 18 Apr 2023 00:00:00 GMThttps://vinishjustin.dev/blog/defence-against-email-fraud-and-abuse/https://vinishjustin.dev/blog/defence-against-email-fraud-and-abuse/SPF, DKIM, and DMARC are three important email authentication protocols that help protect against email fraud and abuse. In this post, we'll dive…Wed, 15 Mar 2023 00:00:00 GMThttps://vinishjustin.dev/blog/brute-force-vs-password-spray/https://vinishjustin.dev/blog/brute-force-vs-password-spray/There are so many different kinds of password attacks. We must comprehend the various attack types in order to recognize and prevent these attacks.Sun, 19 Feb 2023 00:00:00 GMThttps://vinishjustin.dev/blog/siem-backbone-of-soc/https://vinishjustin.dev/blog/siem-backbone-of-soc/SIEM (Security Information and Event Management) provides a comprehensive view of events and incidents by collecting logs from routers to end points…Sat, 11 Feb 2023 00:00:00 GMThttps://vinishjustin.dev/blog/ran-som-ware/https://vinishjustin.dev/blog/ran-som-ware/Ransomware attacks have been occurring for many years, but have become more prevalent in recent times. Some notable ransomware attacks include:Sat, 21 Jan 2023 00:00:00 GMThttps://vinishjustin.dev/blog/dark-web-search-engines/https://vinishjustin.dev/blog/dark-web-search-engines/Onion Services (Search Engines) on the darknet.Tue, 17 Jan 2023 00:00:00 GMThttps://vinishjustin.dev/blog/can-chatgpt-defend-us-against-hackers/https://vinishjustin.dev/blog/can-chatgpt-defend-us-against-hackers/I pressed ChatGPT about its ability to defend us against attackers, and it gave me an intriguing answer.Mon, 16 Jan 2023 00:00:00 GMThttps://vinishjustin.dev/blog/idor-do-you-know-what-i-am-doing/https://vinishjustin.dev/blog/idor-do-you-know-what-i-am-doing/An application provides direct access to an object, such as a file or a database record, based on user-supplied input. This can allow an attacker to…Mon, 16 Jan 2023 00:00:00 GMThttps://vinishjustin.dev/blog/windows-buffer-overflows-32-bit/https://vinishjustin.dev/blog/windows-buffer-overflows-32-bit/[command: !mona jmp -r esp -m "file name"]Fri, 14 Oct 2022 00:00:00 GMThttps://vinishjustin.dev/blog/sysmon-free-edr/https://vinishjustin.dev/blog/sysmon-free-edr/Protecting Endpoints are challenging. It has become more crucial after the COVID pandemic. Work from Home has made Cybersecurity more proactive from…Sun, 14 Aug 2022 00:00:00 GMThttps://vinishjustin.dev/blog/be-ready-for-cyber-war/https://vinishjustin.dev/blog/be-ready-for-cyber-war/If we know how to hack, we can protect us from being hacked. In this Hacking Tutorial, we will see the basics of hacking. But don't try this in…Tue, 05 Apr 2022 00:00:00 GMThttps://vinishjustin.dev/blog/how-organizations-detecting-the-cyber-attacks/https://vinishjustin.dev/blog/how-organizations-detecting-the-cyber-attacks/Organizations running with more than 1000 employees, need to have big infrastructure. Organizations running with more than 100,000 employees need to…Fri, 14 Jan 2022 00:00:00 GMThttps://vinishjustin.dev/blog/top-ransomware-attacks-of-2021/https://vinishjustin.dev/blog/top-ransomware-attacks-of-2021/As we all know, the year 2020 falls out of ordinary circumstances. This is because many organizations were in a situation to adapt to new environment…Wed, 29 Dec 2021 00:00:00 GMThttps://vinishjustin.dev/blog/ewu-gates-are-you-safe/https://vinishjustin.dev/blog/ewu-gates-are-you-safe/Cyber Attacks, you started hearing these words on a daily basis in news and social media. Protecting yourself and your organization from…Wed, 22 Dec 2021 00:00:00 GMT