📊 Splunk SIEM Lab

Deploying and configuring a Splunk SIEM environment to ingest logs from multiple sources, build custom detection searches, and create SOC-ready dashboards — complementing the Azure Sentinel lab with an on-premise SIEM perspective.

---

📋 Project Overview

This lab focuses on setting up Splunk (Free tier) as an on-premise SIEM solution. It covers log ingestion from Windows Event Logs, Syslog, and network devices, followed by the creation of custom SPL (Search Processing Language) searches, correlation rules, dashboards, and alerting — simulating a real SOC analyst workflow.

🎯 Objectives

• Deploy Splunk Free on a local VM and configure data inputs
• Ingest logs from Windows Event Logs, Linux Syslog, and network devices
• Write custom SPL searches to detect suspicious activity
• Build correlation searches to identify multi-stage attack patterns
• Create SOC dashboards for real-time visibility
• Configure alerts and notifications for critical events
• Compare detection capabilities with the Azure Sentinel environment

🛠️ Technologies Used

Technology	Purpose
Splunk Free	SIEM platform
SPL (Search Processing Language)	Log querying & detection
Splunk Universal Forwarder	Log shipping from endpoints
Windows Event Logs	Primary log source
Linux Syslog	Secondary log source
VirtualBox / VMware	Lab virtualization

📁 Repository Structure

splunk-siem-lab/
├── README.md
├── docs/
│   └── architecture-diagram.png      # Coming soon
├── spl-queries/
│   └── detection-searches.md         # Coming soon
├── dashboards/
│   └── soc-dashboard-config.xml      # Coming soon
└── screenshots/
    └── ...                           # Coming soon

🚧 Progress

• Splunk Free installation & initial configuration
• Universal Forwarder deployment on Windows/Linux endpoints
• Windows Event Log ingestion (Security, System, Application)
• Linux Syslog ingestion
• Custom SPL detection searches
• Correlation searches (multi-event attack detection)
• SOC dashboard creation
• Alert configuration & notification setup
• Comparison write-up: Splunk vs Microsoft Sentinel
• Final documentation

📌 Status: In Progress

This project is actively being built. SPL queries, dashboard configurations, and screenshots will be added as each phase is completed.

---

Part of my cybersecurity portfolio — evank95.github.io/My-CV-Page