Home›Splunk Lab
Northgate Engineering / Splunk Enterprise 19 sourcetypes · 7 CIM data models · SPL

Splunk Lab

Write and run real SPL against a Splunk-shaped projection of the Northgate estate: CIM-normalised fields and Sysmon event codes across azure:aad:signin, WinEventLog:Security and Sysmon Operational. Every exercise gives you an editor, runs your query against the data and grades the result, so you practise finding the evidence rather than reading about it.

17Exercises
315Minutes of work
19Sourcetypes
7CIM data models
Read the prompt→ Write SPL→ Run→ Graded

Investigations

Multi-phase scenarios at full analyst depth, triage, investigate across the data, decide containment. Scored end to end.

Investigation Live
Ransomware Pre-Encryption on an Endpoint
A P1 multi-phase investigation in Splunk. An EDR alert flags shadow-copy deletion on a Finance endpoint. Triage, confirm the destruction, trace the dropper and its C2, find the persistence, then choose containment, scored end to end. Sysmon EC1/3/13/22.
Sysmon backbone~35 min

Practitioner Drills

Single-query exercises to build one SPL skill at a time. Start here.

Practitioner Live
Hunt a Password Spray
A burst of failed Entra sign-ins. Use stats and dc() to find the source address touching many distinct users, which is the spray signature, rather than the one hammering a single account.
azure:monitor:aad~15 min
Practitioner Live
The One That Got Through
A spray that fails entirely is a report; a spray with one success is an intrusion. Establish whether any authentication from the spray source succeeded, against which account, and when.
azure:monitor:aad~15 min
Practitioner Live
Travel That Should Not Be Possible
Almost every sign-in on this estate originates in Great Britain. Find the accounts spanning more than one country and read which, where rarity rather than an absolute rule does the discriminating.
azure:monitor:aad~15 min
Practitioner Live
Tools That Have No Business Being There
An engineering laptop should never run offensive tooling. Find the credential-access and directory-enumeration binaries, and the parent process that launched each one.
Sysmon EventCode 1~15 min
Practitioner Live
A Document That Started a Shell
A Word document does not launch PowerShell during normal work. One instance exists in nineteen thousand process events. Write the parent-child detection that finds it.
Sysmon EventCode 1~15 min
Practitioner Live
A Command Line You Cannot Read
Encoding a PowerShell command is a feature and a habit. Find the encoded invocations and carry the command line into the output so the finding evidences itself.
Sysmon EventCode 1~15 min
Practitioner Live
Destroying Recovery Before Encrypting
Shadow copies deleted, backup catalog wiped, boot recovery disabled. Find the sequence in the process data and order it into a timeline.
Sysmon EventCode 1~20 min
Practitioner Live
Detect Recovery Destruction in Sysmon
The command-line form of the same question: hunt vssadmin, wbadmin and bcdedit on their arguments, excluding the benign read-only use that fills a naive process-name rule.
Sysmon EventCode 1~20 min
Practitioner Live
Follow the Bytes
The proxy records bytes sent on every outbound request. Total them by destination and find where an implausible amount of data went.
squid:access~15 min
Practitioner Live
The Address on Both Sides
You have an exfiltration destination. Try it against the identity plane: an address that took your data has often also had your credentials.
azure:monitor:aad~15 min
Practitioner Live
Blocked, Blocked, Allowed
Find the source and destination pairs the firewall both denied and allowed. The trap is that this firewall logs three actions, not two.
pan:traffic~15 min
Practitioner Live
Knocking on Locked Doors
An attacker with stolen credentials finds out what they can do by trying. Treat the CloudTrail denial trail as signal and find the principals mapping their own permissions.
aws:cloudtrail~15 min

Advanced Drills

Prevalence analysis, time bucketing and multi-stage aggregation, where the discriminator has to be earned rather than filtered for.

Advanced Live
Software Only One Machine Runs
Named-tool detections break on a rename; prevalence does not. Rank the process inventory by distinct host count and read the bottom of the list.
Sysmon EventCode 1~20 min
Advanced Live
The Heartbeat in the Proxy Log
Malware checks in on a timer and people do not. Bucket time into fixed windows and find the destination that appears in almost all of them, exactly once each.
squid:access~25 min
Advanced Live
Data Hidden in Domain Names
A tunnel encodes payload into subdomain labels, so it never queries the same name twice. Find the parent domain whose subdomain cardinality is wildly out of proportion.
stream:dns~25 min
Advanced Live
Turning Off the Cameras
Before doing the thing, an attacker stops you recording it. Find the principals who called several different security-disabling APIs, not merely one repeatedly.
aws:cloudtrail~20 min