Splunk SOC investigation: detection to scheduled alert
A synthetic authentication pattern moved from source events to an indexed detection and one native fired-alert record, with a traceable analyst handoff.
Controlled lab confirmed November 8, 2026. The indexed search matched the expected data and a scheduled Splunk job fired once. This is not a real compromise or a production detection benchmark. New-run screenshots are still pending.
The case in 30 seconds
Five or more failed logins followed by a success for the same user and IP can be a credential-access investigation lead. I worked on the lab's exact ten-minute boundary, success reset, and negative checks. Its live confirmation indexed the original 64 fabricated events plus six fresh replay events, matched all five expected findings, and captured the scheduled search result before disabling the temporary alert.
The important result is a complete evidence path from fabricated input to an actual Splunk scheduling outcome—not evidence that an attacker gained access.
- Indexed evidence
- 70 source-equal fabricated authentication events; native UTC timestamps checked.
- Confirmed
- Detection quality
- 5/5 expected findings; supplied negative scenarios produced no extras.
- Confirmed
- Scheduled alert
- One native tracked alert, one completed scheduled job, one exact replay result.
- Confirmed
- Safe closure
- Retained the job and alert before disabling the temporary schedule. No external action enabled.
- Complete
How I would investigate
- Signal
- At least five failures within an inclusive 600-second window, followed by a success; correlation is isolated by username and source IP, and an intervening success resets the streak.
- Alternative explanations
- Forgotten-password retries, password-manager errors, authorized recovery, stale service credentials, or shared network egress can produce a similar pattern.
- Next analyst action
- Verify MFA and session history, device identity, account-owner activity, source-IP context, and endpoint telemetry. Open a review ticket and escalate only if corroborating evidence and local procedures justify it.
No real account was locked, endpoint isolated, or notification sent in this lab.
Inspect the evidence
The live observation and its checks are documented in the project repository. Private authenticated responses remain outside Git; the public case study provides the run ID, validated counts, evidence hashes, and explicit limitations.
What remains before the full showcase
Capture genuine redacted screenshots of the indexed search, all five original findings, the native scheduled alert, and its exact replay result. Record a short owner walkthrough. The earlier saved five-finding panel is a separate capture; it must not stand in for screenshots of this newer live confirmation.
The live run used an already-authenticated local Splunk CLI adapter; the separate HTTPS bearer-token verifier was not the executed entrypoint. This is not independent attestation, a dashboard-rendering test, a measured false-positive rate, or production incident experience. The cause of an earlier missing saved artifact remains unresolved. The temporary scheduled alert is disabled.