Splunk Threat Investigation Playbook
Work through authentication, endpoint execution and persistence questions with source-aware searches.
Three useful investigation paths
This playbook expands the multi-source Splunk case with specific questions an analyst can work through. The searches below are illustrative starting points for exported or ingested lab data. Indexes, field names, audit configuration and source coverage must match the actual environment.
Repeated authentication failures followed by success
Start with the affected accounts, source addresses and time range. Inspect the event sequence; a count alone does not establish that failures preceded the success. Consider ordinary mistakes, administrative activity and shared addresses, then seek session or endpoint context.
index=lab EventCode IN (4624, 4625)
| eval outcome=if(EventCode=4624, "success", "failure")
| table _time host TargetUserName IpAddress EventCode outcome
| sort 0 _timeThis table preserves events for review; it is not a deployed correlation alert. The separate public authentication case contains a tested inclusive-window detector.
Unexpected PowerShell or other process execution
Review parent process, user, command line and host context in available Sysmon process-creation events. Correlate relevant PowerShell logging and network events when collected. An encoded command or unusual parent relationship is a lead; legitimate automation remains a competing explanation.
index=lab source="*Sysmon*" EventCode=1
| table _time host User ParentImage Image CommandLine
| sort 0 _timeSuspicious persistence or scheduled activity
Where available, inspect task-creation or change records, the initiating account and the executable or script. Compare the timing with nearby process execution and approved administration. Explain missing telemetry rather than filling gaps with a presumed attack chain.
Turn searches into an investigation
- Validate the sources
- Confirm time interpretation, host identity, field extraction and which event channels were actually collected.
- Build a timeline
- Keep the original source references attached to observations across identity, endpoint and network data.
- Challenge the interpretation
- Use benign comparison activity and document what would disprove the current hypothesis.
- Explain the disposition
- State whether the case needs more collection, escalation or closure, and why.
Academic foundation
Completed coursework: IST 5250 Incident Handling & Cyber Investigation and IST 4910 Enterprise Systems Administration (Fall 2024).
Scope
Investigation playbook and example searches, not newly executed Splunk results. No ingested dataset, fired alert, dashboard capture or incident outcome is invented. The broader completed résumé lab and the smaller reproducible exercises retain their own evidence scope.