Lab 23: Writing My First Splunk Detection Rule
How I wrote an SPL query to detect SSH brute force activity, configured a real-time Splunk alert, and validated it against 75 live events.
Written by
Cybersecurity walkthroughs, CTF writeups, and notes from the field. From zero to root.
Self-taught cybersecurity practitioner documenting the path from zero to root. SOC analyst, CTF player, detection engineer. 29 hands-on labs and counting.
Responses
Markdown supported · ⌘↵ to post
No responses yet.