This repository provides production-ready detection rules and detection engineering methodology:

1. 📚 Production Detection Library: 50+ battle-tested SPL correlation searches ready for immediate deployment in your Splunk environment.
2. 🛠️ Detection Engineering Reference:
   • Framework Guide - Naming conventions & standards.
   • Lifecycle Guide - Technical guide on creating rules (Native SPL).

Repository Value: Deploy our detection logic as-is, adapt it to your environment, or use our proven patterns as references when building your own custom detections.

✅ Battle-tested - Validated across enterprise environments
✅ Low noise - Tuned for <5% false positive rate
✅ MITRE-mapped - Aligned to ATT&CK framework
✅ Response-ready - Includes investigation playbooks
✅ CIM-Compatible - Aligned with Common Information Model (Best Practice)

Organized into 8 practical categories covering the full attack lifecycle:

• Splunk Enterprise Security 7.0+
• Required Technical Add-ons (TAs) for your data sources
• Accelerated CIM data models (Authentication, Endpoint, Network Traffic) (Optional)

1. Browse the detection categories above (e.g., Authentication/T1110_Brute_Force.spl).
2. Copy the production-ready SPL query.
3. Test in your Splunk environment to validate data visibility.
4. Deploy as a Correlation Search in Enterprise Security.

1. Start with a production rule from the library.
2. Customize for your environment:
   • Adjust thresholds based on your baseline
   • Add environment-specific exclusions
   • Modify field names to match your data model
3. Reference the templates/ directory for detection pattern examples.

1. Fork this repository.
2. Improve existing rules or add new detection logic.
3. Submit a Pull Request to share your work with the community.

Whether you are using our rules or building your own, we recommend this standard workflow:

graph TD
    A[1. Select Logic] --> B{Source?}
    B -->|Our Library| C[3. Test with Data]
    B -->|Custom Template| D[2. Write SPL Query]
    D --> C
    C --> E{FP Rate?}
    E -->|>5%| F[4. Tune Filters]
    F --> C
    E -->|<5%| G[5. Document FPs]
    G --> H[6. Peer Review]
    H --> I[7. Deploy to Production]
    I --> J[8. Monitor 48hrs]
    
    style A fill:#2563eb,color:#fff,stroke:#1e40af,stroke-width:3px
    style I fill:#16a34a,color:#fff,stroke:#15803d,stroke-width:3px
    style E fill:#ea580c,color:#fff,stroke:#c2410c,stroke-width:3px

Our rules are built for Search Efficiency. We prioritize filtering by index and sourcetype early in the pipeline to ensure speed without relying on accelerated data models.

Example Logic:

index=security sourcetype=WinEventLog:Security EventCode IN (4625, 4624)
| eval action=case(
    EventCode=4625, "failure",
    EventCode=4624, "success",
    1=1, "unknown"
)
| stats 
    count(eval(action="failure")) as failed_attempts,
    count(eval(action="success")) as successful_attempts
    by user, dest
| where failed_attempts >= 5 AND successful_attempts >= 1

Before deploying, validate the logic using Event-Horizon.

Recommended Tool: Event-Horizon

Use Event-Horizon to generate production-quality security logs for validation:

• Realistic Data: Generate logs for 80+ technologies (Palo Alto, Windows, AWS, etc.).
• Golden Master Templates: Ensure 100% format accuracy for testing field extractions.
• AI Attack Simulation: Orchestrate coordinated kill chains to validate correlation rules.

We welcome contributions! If you've created a rule using our templates or optimized one of ours:

1. Fork this repository.
2. Create a feature branch.
3. Submit a Pull Request with your detection logic and testing results.

PrototypePrime (Mathan Subbiah)
Senior Security Engineer | Detection Engineering Specialist

Focused on building scalable detection systems and security tooling that accelerate threat detection, validation, and training workflows.

• Event-Horizon - Production-quality security log generator
• Microsoft Defender KQL Detection
• Cortex XDR XQL Detection

MIT License - see LICENSE file for details.