https://www.logsec.cloud/tags/splunk/ Recent content in splunk on logsec Hugo -- gohugo.io Fri, 02 Oct 2020 00:00:00 +0000 https://www.logsec.cloud/posts/splunk-range-setup/ Fri, 02 Oct 2020 00:00:00 +0000 https://www.logsec.cloud/posts/splunk-range-setup/ Notes and fixes for building Splunk Attack Range on AWS, then simulating Zerologon (CVE-2020-1472) against the lab domain controller. https://www.logsec.cloud/posts/splunk-enterprise-certified-admin/ Tue, 22 Sep 2020 00:00:00 +0000 https://www.logsec.cloud/posts/splunk-enterprise-certified-admin/ Study notes for the Splunk Enterprise Certified Admin (SPLK-1003) exam, organized by the exam blueprint with the docs and videos I used. https://www.logsec.cloud/posts/detect-public-s3-bucket-using-splunk/ Sat, 20 Jun 2020 00:00:00 +0000 https://www.logsec.cloud/posts/detect-public-s3-bucket-using-splunk/ Splunk searches over CloudTrail logs that catch S3 buckets made public through the console, canned ACLs or grant flags, plus how to respond and prevent it. https://www.logsec.cloud/posts/investigating-on-aws/ Thu, 04 Jun 2020 00:00:00 +0000 https://www.logsec.cloud/posts/investigating-on-aws/ Investigating unknown AWSConfig requests against S3 buckets, reproducing them in a lab, and how AWS Config could be used to check whether a bucket exists. https://www.logsec.cloud/posts/ingest-vpc-flow-logs-to-splunk/ Fri, 01 May 2020 00:00:00 +0000 https://www.logsec.cloud/posts/ingest-vpc-flow-logs-to-splunk/ Create VPC Flow Logs with extra metadata fields using Terraform, ship them to Splunk through S3 and SQS, and update props.conf to parse the new fields. https://www.logsec.cloud/posts/ingest-cloudtrail-logs-to-splunk/ Mon, 20 Apr 2020 00:00:00 +0000 https://www.logsec.cloud/posts/ingest-cloudtrail-logs-to-splunk/ Build a Splunk lab on AWS with Terraform and ingest CloudTrail logs through S3 and SQS using the Splunk Add-on for AWS.