kh4sh3i / splunk

a useful tutorial about splunk and security splunk app

Splunk toturial

Splunk is a software technology that uses the data generated by the computer to track, scan, analyze, and visualize it in real-time. It tracks and read store data as indexer events and various types of log files. It enables us to view data in different Dashboard formats.

Product Categories

• Splunk Enterprise: It is used by companies which have large IT infrastructure and IT driven business. It helps in gathering and analysing the data from websites, applications, devices and sensors, etc.
• Splunk Cloud: It is the cloud hosted platform with same features as the enterprise version. It can be availed from Splunk itself or through the AWS cloud platform.
• Splunk Light: It allows search, report and alert on all the log data in real time from one place. It has limited functionalities and features as compared to the other two versions.

TIP: we use Splunk Enterprise!

splunk sensor

splunk collect log from diffrent sensor like security device or network device or services,...

• IIS
• wazuh
• nginx
• windows server
• Linux
• Cisco
• mikrotik
• Fortinet

Tip: we install splunk universal forwarder app for remote data collection.

splunk lisence

for buying splunk lisence we create RFP and estimate EPS and sizing of storage.

• RFP = request for proposal
• ESP = Event per secend

Splunk Storage Sizing

Specify the amount of time to retain data for each category. Data will be rolled through each category dependant on its age.

• Hot storage = NVME,SSD -> 30day
• Warm storage = HDD,SAS 15k -> 6 mon
• Cold storage = 10k,tape -> 1 year

splunk App

splunk developer make app and connect to other IOT, Devices, social media , ... and collect log and create role for analysis data and make a beautiful dashboard. this is a pstn dashboard.

splunk database structure

• sql BD = use Ram , good for data analysis => like mysql
• Nosql BD = use storage , good for Big data analysis => like mongodb
• distributed database = splunk + hadoop( use map reduce) => project HUNK

Tip: hunk project dose not famouse and never use. splunk use mongodb for storing data

splunk data pipeline

• raw data (add host,source metadata field to any log row)
• parsing (add timestamp and make beautiful format for field of data
• indexing (we create multiple indexing splunk docker for better search)
• search (use tag,macro and other field for search data)

splunk query for port scan detection

• Vertical Port Scan: External IP performing scan on single system for multiple ports

index=trafficlogs | stats dc(dest_port) as dc_dest_port by src, dest| where dc_dest_port > 10

• Horizontal Port Scan: External IP is scanning multiple systems for querying single port.

index=trafficlogs| stats dc(dest) as dc_dest by src, dest_port| where dc_dest > 10

Splunk Attack Range

A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

splunk MITRE ATT&CK map support

Splunk Security Essentials

Get started with Splunk for Security with Splunk Security Essentials (SSE). Explore security use cases and discover security content to start address threats and challenges.

Splunk Enterprise Security

Splunk Enterprise Security (ES) solves a wide range of security analytics and operations use cases including continuous security monitoring, advanced threat detection, compliance, incident investigation, forensics and incident response. Splunk ES delivers an end-to-end view of organizations’ security postures with flexible investigations, unmatched performance, and the most flexible deployment options offered in the cloud, on-premises or hybrid deployment models. Splunk ES enables you to:

reference

• splunk toturial
• splunk doc