threat_generator

Conduct threat hunts in Splunk using the PEAK framework (Prepare, Execute, Act with Knowledge). Supports hypothesis-driven, baseline, and model-assisted hunts. Use when the user wants to threat hunt, investigate security anomalies, baseline data sources, detect adversary techniques, or map findings to MITRE ATT&CK.

Configure Splunk Enterprise Security 8 Exposure Analytics to auto-discover Assets, IPs, Users, and MAC addresses from ThreatGen events streaming into index=threat_gen. Use when the user wants to set up Exposure Analytics entity discovery, populate Asset/IP/User/MAC inventories, or validate that ThreatGen events carry the required CIM-aligned entity fields (nt_host, ip, user_id, mac).