SIEM · Threat Detection

Splunk SIEM
Monitoring

2024 Splunk Enterprise · Nessus · SPL Simulated scenario — Vandalay Industries

Used Splunk Enterprise to detect and analyse simulated DDoS, brute-force, and vulnerability scan events. Built custom dashboards, saved searches, and threshold-based alerts. Correlated Nessus vulnerability output with Apache access logs to surface active threat vectors in a lab environment.

Splunk SPL Nessus DDoS Detection Brute Force Log Correlation Dashboard Alerting
View on GitHub ← Back to projects
Overview

Scenario

Vandalay Industries (a simulated enterprise) is under multi-vector attack. As the acting SOC analyst I ingested web server logs, Nessus scan results, and Windows event logs into Splunk, then built detection queries and dashboards to identify active threats in real time.

All data is from a controlled lab dataset. No production systems were involved.

3Attack Types
5SPL Queries
2Dashboards
4Alerts Created
Detections

Threats Identified

AttackSourcetypeIndicatorSeverity
DDoS — HTTP Flood access_log 500+ req/min from single IP HIGH
SSH Brute Force WinEventLog Event ID 4625 spike > 50/min HIGH
Nessus Vuln Scan nessus Critical/High findings on port 80 MED
Recon — Port Scan access_log Sequential port probes, short TTW LOW
SPL Queries

Search Queries

DDoS detection — high request rate from single IP:

index=main sourcetype=access_log
| stats count by clientip, uri_path
| where count > 500
| sort - count
| rename clientip as "Source IP", count as "Requests"

SSH brute force — failed logins from Windows event log:

index=main sourcetype=WinEventLog EventCode=4625
| stats count by src_ip, user, _time
| eval time_bucket=strftime(_time, "%Y-%m-%d %H:%M")
| stats sum(count) as total_failures by src_ip, time_bucket
| where total_failures > 50
| sort - total_failures

Nessus — critical and high vulnerabilities correlated with web log activity:

index=nessus severity IN ("Critical","High")
| join host [
    search index=main sourcetype=access_log
    | stats count by host
  ]
| table host, plugin_name, severity, description, count
| sort - severity, - count
Dashboards

What I Built

Attack Overview Dashboard Real-time panels showing: top attacking IPs (timechart), request volume by minute (area chart), HTTP status code distribution (pie chart), geographic source map. Used time range picker for historical analysis.
Brute Force Monitor Panel Event ID 4625 count over time, top targeted usernames, source IP reputation overlay. Threshold alert fires when 50+ failures in a 5-minute window from a single source.
Vulnerability Correlation View Joined Nessus scan results with live Apache logs — shows which vulnerable hosts are actively receiving traffic, ranked by Nessus CVSS score. Helps prioritise patching for actively targeted assets.
Alerting

Alert Configuration

  1. 1
    DDoS Alert — scheduled every 5 min; triggers when any single IP exceeds 500 requests to /. Action: email + Splunk notable event.
  2. 2
    Brute Force Alert — real-time; EventCode=4625 count > 50 in 5-min window. Action: Splunk notable + suppress for 30 min after first fire per source IP.
  3. 3
    Critical Vuln Alert — daily; any new Nessus Critical finding on externally reachable hosts. Action: email to security team distribution list.
  4. 4
    Recon Alert — hourly; sequential port probe pattern (> 20 distinct ports in 60 s from one IP). Action: notable event with MITRE T1046 tag.
Outcome

What I Learned