Splunk
SIEMSearch and analyse machine data, including security logs.
Who uses it?
SOC analysts, detection engineers, IT operations and incident responders.
Best for
Log analysis, threat detection, incident investigation
Similar tools
Microsoft Sentinel, QRadar
What is it?
Splunk is a platform for collecting, indexing and searching machine-generated data. Its security offerings are used as a SIEM.
What problem does it solve?
Logs are scattered across many systems in different formats. Splunk brings them together so they can be searched and alerted on.
How does it work?
Data is forwarded from servers, endpoints, network devices and cloud services. It is indexed and made searchable using Splunk's Search Processing Language (SPL). Saved searches, correlation rules and dashboards turn the data into alerts and views.
Simple example
index=security sourcetype=authentication action=failure
| stats count by src_ip
| where count > 10An illustrative query that surfaces source IPs with many failed login attempts.
When would a SOC analyst use it?
When an alert fires and the analyst needs to pull every related event for a user, host or IP address to build a timeline.
How does it work?
- 1Data is forwarded from servers, endpoints, network devices and cloud services.
- 2It is indexed and made searchable using Splunk's Search Processing Language (SPL).
- 3Saved searches, correlation rules and dashboards turn the data into alerts and views.
Simple example
Search for many failed sign-ins followed by a success for the same account within a short window, then alert when it occurs.
index=security sourcetype=authentication action=failure
| stats count by src_ip
| where count > 10An illustrative query that surfaces source IPs with many failed login attempts.
When would a SOC analyst use it?
When an alert fires and the analyst needs to pull every related event for a user, host or IP address to build a timeline.
Who uses it?
SOC analysts, detection engineers, IT operations and incident responders.
Pros
- Very flexible search language
- Handles many kinds of data
- Large app and integration ecosystem
Cons
- Can be costly at large data volumes
- SPL takes time to learn
- Needs tuning to avoid noisy alerts
