Don Lopez

Splunk Authentication Investigation Workflow

Splunk · Python · Detection logic · Evidence handling

Connected a Splunk authentication export to Python validation, UTC timelines and source-linked reporting. The result is a traceable handoff for SOC investigation—not a claim of confirmed compromise.

Active Directory attack-chain investigation

Recorded OTRF emulation · Independent analysis · Python / Sysmon / PCAP

Question

Can one process connect activity on three targets?

My work

Joined process GUIDs, logon sessions and packet tuples; separated execution from collection time.

Result

Six qualified findings with exact source references and competing administration explanations.

Read the concise incident report ↗

Splunk SOC investigation: detection to scheduled alert

Authorized synthetic lab · Splunk SPL / Python · Native alert evidence

Question

Can an authentication-burst rule survive indexing and fire on schedule?

My work

Corrected the inclusive 600-second boundary, challenged negative scenarios, and captured source-bound alert evidence.

Result

70 indexed synthetic events, five expected findings, and one confirmed native scheduled alert; the temporary schedule is off.

Inspect the boundary test ↗