Lab 23: Writing My First Splunk Detection Rule

Lab 22 got Splunk running. 180 events indexed. 76 SSH brute force events confirmed in the index. The pipeline was alive. But a SIEM with no detection rules is still just a search engine. Lab 23 is whe