triaging-security-alerts-in-splunk

name	triaging-security-alerts-in-splunk
description	Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when SOC analysts face queued alerts from correlation searches, need to prioritize investigation order, or must document triage decisions for handoff to Tier 2/3 analysts.
domain	cybersecurity
tags	["soc","splunk","alert-triage","siem","notable-events","correlation-search","incident-review"]
subdomain	soc-operations
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Triaging Security Alerts In Splunk

Overview

Cybersecurity skill for triaging security alerts in splunk. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "triaging security alerts in splunk"
• "SOC Tier 1 analysts need to process the Incident Review queue in Splunk Enterpri"
• "Notable events require rapid severity classification and initial investigation b"
• "Alert volume exceeds capacity and analysts need a systematic triage methodology"

Use this skill when:

• SOC Tier 1 analysts need to process the Incident Review queue in Splunk Enterprise Security (ES)
• Notable events require rapid severity classification and initial investigation before escalation
• Alert volume exceeds capacity and analysts need a systematic triage methodology
• Management requests metrics on alert disposition (true positive, false positive, benign)

Do not use for deep forensic investigation — escalate to Tier 2/3 after initial triage confirms malicious activity.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Splunk Enterprise Security 7.x+ with Incident Review dashboard configured
• CIM-normalized data sources (Windows Event Logs, firewall, proxy, endpoint)
• Role with ess_analyst capability for notable event status updates
• Familiarity with SPL (Search Processing Language)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}