building-detection-rule-with-splunk-spl

name	building-detection-rule-with-splunk-spl
description	Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments. Use when building effective detection rules using splunk search processing language (spl).
domain	cybersecurity
subdomain	soc-operations
tags	["splunk","spl","detection-engineering","correlation-search","siem","soc","threat-detection","enterprise-security"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Building Detection Rules with Splunk SPL

Overview

Splunk Search Processing Language (SPL) is the primary query language used in Splunk Enterprise Security for building correlation searches that detect suspicious events and patterns. A well-crafted detection rule aggregates, correlates, and enriches security events to generate actionable notable events for SOC analysts. Enterprise SIEMs on average cover only 21% of MITRE ATT&CK techniques, making skilled SPL rule writing essential for closing detection gaps.

When to Use

Trigger phrases:

• "building detection rule with splunk spl"

• "Build effective detection rules using Splunk Search Processing Language (SPL) co"

• When deploying or configuring building detection rule with splunk spl capabilities in your environment

• When establishing security controls aligned to compliance requirements

• When building or improving security architecture for this domain

• When conducting security assessments that require this implementation

Prerequisites

• Splunk Enterprise Security (ES) deployed and configured
• Access to Splunk Search & Reporting app with appropriate roles
• Understanding of Common Information Model (CIM) data models
• Familiarity with MITRE ATT&CK framework techniques
• Knowledge of the organization's log sources and data flows

Core SPL Detection Rule Patterns

• Follow the principle of least privilege — use the minimum permissions needed for each task
• Document everything — maintain logs of all actions, configurations, and findings
• Verify before acting — confirm assumptions about the environment before making changes
• Automate repetitive steps — script common workflows to reduce human error

1. Threshold-Based Detection

Detects events exceeding a defined count within a time window.

index=wineventlog sourcetype=WinEventLog:Security EventCode=4625
| stats count as failed_logins dc(TargetUserName) as unique_users by src_ip
| where failed_logins > 10 AND unique_users > 3
| eval severity="high"
| eval description="Brute force attack detected from ".src_ip." with ".failed_logins." failed logins across ".unique_users." accounts"

2. Sequence-Based Detection (Failed Login Followed by Success)

Correlates a sequence of events indicating a successful brute force attack.

index=wineventlog sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624)
| eval login_status=case(EventCode=4625, "failure", EventCode=4624, "success")
| stats count(eval(login_status="failure")) as failures count(eval(login_status="success")) as successes latest(_time) as last_event by src_ip, TargetUserName
| where failures > 5 AND successes > 0
| eval description="Account ".TargetUserName." compromised via brute force from ".src_ip
| eval urgency="critical"