--- title: "#splunk articles | Hashnode" description: "Explore 132 articles tagged #splunk on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/splunk" --- Tag # #splunk 132 posts · 42 followers [Jebitok](https://hashnode.com/@w1t3r) · [Oct 26](https://hashnode.com/posts/the-o365-intrusion-splunk-tryhackme/6adf26a5a268e996cf68ac0d) ### [The O365 Intrusion - Splunk (TryHackMe)](https://www.sharonjebitok.com/the-o365-intrusion-splunk-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the O365 Intrusion on TryHackMe Active investigation High Situation Report Vantage Dynamics' IT team escalated a report from their Accounts Payable department on 27 August. An employee, Marc 5 min read · [sharonjebitok.com](https://www.sharonjebitok.com/the-o365-intrusion-splunk-tryhackme?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Oct 26](https://hashnode.com/posts/the-finance-trail-splunk-tryhackme/6adf0b1f7c31f4483f1267f6) ### [The Finance Trail - Splunk (TryHackMe)](https://www.sharonjebitok.com/the-finance-trail-splunk-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the Finance Trail challenge on TryHackMe Case Briefing The numbers do not add up. You have been brought on at THM Security Services (TSS). Click the card below to reveal your role on this case 7 min read · [sharonjebitok.com](https://www.sharonjebitok.com/the-finance-trail-splunk-tryhackme?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Oct 26](https://hashnode.com/posts/benign-splunk-tryhackme/6adefee27374d2cffa16e090) ### [Benign - Splunk (TryHackMe)](https://www.sharonjebitok.com/benign-splunk-tryhackme?utm_source=hashnode&utm_medium=feed) Link to Benign challenge on TryHackMe Introduction We will investigate host-centric logs in this challenge room to find suspicious process execution. To learn more about Splunk and how to investigate 3 min read · [sharonjebitok.com](https://www.sharonjebitok.com/benign-splunk-tryhackme?utm_source=hashnode&utm_medium=feed) [routetoroot](https://hashnode.com/@routetoroot) · [Sep 29](https://hashnode.com/posts/lab-24-the-attack-ran-the-alerts-fired/6abb2d3c98db7171e65a261a) ### [Lab 24: The Attack Ran. The Alerts Fired.](https://blog.routetoroot.io/lab-24-the-attack-ran-the-alerts-fired?utm_source=hashnode&utm_medium=feed) I ran a live SSH brute force simulation against Kali Linux. Splunk fired 15 real-time alerts in under 2 seconds. Here's the full detection pipeline breakdown. 4 min read · [blog.routetoroot.io](https://blog.routetoroot.io/lab-24-the-attack-ran-the-alerts-fired?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 23](https://hashnode.com/posts/zero-tolerance-tryhackme/6ab3e1d4e4848307dc8dd5c6) ### [Zero Tolerance (TryHackMe)](https://www.sharonjebitok.com/zero-tolerance-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: Zero Tolerance It was supposed to be a regular morning at ProbablyFine Ltd. L2 had just returned from paternity leave. L3 was hosting a live webinar on "Proactive 7 min read · [sharonjebitok.com](https://www.sharonjebitok.com/zero-tolerance-tryhackme?utm_source=hashnode&utm_medium=feed) [3](https://hashnode.com/posts/zero-tolerance-tryhackme/6ab3e1d4e4848307dc8dd5c6) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 23](https://hashnode.com/posts/promotion-night-splunk-tryhackme/6ab3bc28395b5d72e0960e1b) ### [Promotion Night: Splunk (TryHackMe)](https://www.sharonjebitok.com/promotion-night-splunk-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: Promotion Night It was a glorious Friday at ProbablyFine Ltd. After weeks of sales calls and PoC demos, the team finally signed a contract with DeceptiTech - a maj 16 min read · [sharonjebitok.com](https://www.sharonjebitok.com/promotion-night-splunk-tryhackme?utm_source=hashnode&utm_medium=feed) [routetoroot](https://hashnode.com/@routetoroot) · [Sep 22](https://hashnode.com/posts/lab-23-writing-my-first-splunk-detection-rule/6ab1fff8beae88aed7ea27a3) ### [Lab 23: Writing My First Splunk Detection Rule](https://blog.routetoroot.io/lab-23-writing-my-first-splunk-detection-rule?utm_source=hashnode&utm_medium=feed) How I wrote an SPL query to detect SSH brute force activity, configured a real-time Splunk alert, and validated it against 75 live events. 4 min read · [blog.routetoroot.io](https://blog.routetoroot.io/lab-23-writing-my-first-splunk-detection-rule?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 22](https://hashnode.com/posts/splunk-exploring-spl-tryhackme/6ab245bd30b1b70f5a0a6d78) ### [Splunk: Exploring SPL (TryHackMe)](https://www.sharonjebitok.com/splunk-exploring-spl-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: Splunk: Exploring SPL index=windowslogs index=windowslogs earliest="04/15/2022:08:05:00" latest="04/15/2022:08:06:00" | stats count index=windowslogs EventI 2 min read · [sharonjebitok.com](https://www.sharonjebitok.com/splunk-exploring-spl-tryhackme?utm_source=hashnode&utm_medium=feed) [routetoroot](https://hashnode.com/@routetoroot) · [Sep 11](https://hashnode.com/posts/lab-22-same-logs-new-siem-setting-up-splunk-from-scratch/6aa34d8cd98c11b112aa136f) ### [Lab 22: Same Logs, New SIEM — Setting Up Splunk From Scratch](https://blog.routetoroot.io/lab-22-same-logs-new-siem-setting-up-splunk-from-scratch?utm_source=hashnode&utm_medium=feed) How I installed Splunk Enterprise 10.2.2 on Kali Linux, configured auth.log ingestion, and confirmed 76 SSH brute force events indexed. 4 min read · [blog.routetoroot.io](https://blog.routetoroot.io/lab-22-same-logs-new-siem-setting-up-splunk-from-scratch?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 9](https://hashnode.com/posts/response-and-recovery-tryhackme/6aa1550f1d1b97b41b31bee7) ### [Response and Recovery (TryHackMe)](https://www.sharonjebitok.com/response-and-recovery-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: Response and Recovery Introduction Response and Recovery picks up where Detection and Analysis left off: the investigation into the compromised l.chen@nexusfinancia 2 min read · [sharonjebitok.com](https://www.sharonjebitok.com/response-and-recovery-tryhackme?utm_source=hashnode&utm_medium=feed)