siem_fun

Build a structured data dictionary for a Splunk instance by discovering accessible indexes, sourcetypes, fields, sample values, and permission limits. Use when the user wants to inventory Splunk data, generate data dictionary JSON, or prepare schema context for SIEM query generation. Do not use for writing hunt queries unless the goal is first to discover Splunk schema.

Build Splunk queries that span multiple user-provided indexes with Splunkbase add-on sourcetype and field knowledge, and optionally enrich results with GreyNoise threat intelligence. Use when the user provides a list of indexes, names a Splunkbase add-on or vendor product, or requests IP-based enrichment in a Splunk environment. Do not use for Sentinel/KQL queries, data dictionary generation, or single-index queries where the schema is fully known.

Build and optimize Splunk SPL and Microsoft Sentinel KQL for SIEM hunts, detections, triage, tuning, and SPL/KQL translation using real environment metadata and internal data-dictionary URLs. Use when the user wants query authoring, optimization, or translation in Splunk or Sentinel. Do not use for SIEM deployment, connector setup, platform administration, or generic security education without a query-building objective.