splunk-security_content/docs

Welcome to Splunk Security Research

View Our Content

You can review our analytics stories by category here, or in our Splunk App.

Is the command line more your flavor? Check out our API:

curl -s https://content.splunkresearch.com | jq
{
  "hello": "welcome to Splunks Research security content api",
  "available_endpoints": [
    "/stories",
    "/detections",
    "/investigations",
    "/baselines",
    "/responses",
    "/package"
  ]
}

Execute Our Content

We have built the the Analytics Story Execution App (ASX) specifically "run" Analytics Stories in Splunk.

Test Our Content

The attack_range project allows you to spin up an enviroment and launch attacks against it in order to test all our detections.

Questions?

Stuck, need help with any of our tools, see our support options.

Contribute Content

Ready to give back and contribute your detections back to the community. See our contributor guide.

Content Spec Documentation

• Story
• Detections
• Investigations
• Responses
• Baselines