How bmalin77/master-of-the-soc---splunk works
This repository is a Splunk SOC-analysis exercise for monitoring VSI’s Windows server and Apache website. The documented workflow is to load the supplied logs into Splunk, analyze their fields, and build reports, threshold alerts, and time-filterable dashboards; alerts email the SOC. The README describes the intended artifacts, but no implementation or saved Splunk configuration is present, so artifact nodes have no source path. Relationships below reflect documentation, not inspected runtime code.
Main entry points: 2-Homework_19-SIEMs-2_resources_windows_server_logs.csv Windows server logs · 2-Homework_19-SIEMs-2_resources_windows_server_attack_logs.csv Windows attack logs · 2-Homework_19-SIEMs-2_resources_apache_logs.txt Apache server logs · 2-Homework_19-SIEMs-2_resources_apache_attack_logs.txt Apache attack logs
Components 16
Log datasets
- Windows server logs
Resources/2-Homework_19-SIEMs-2_resources_windows_server_logs.csv - Windows attack logs
Resources/2-Homework_19-SIEMs-2_resources_windows_server_attack_logs.csv - Apache server logs
Resources/2-Homework_19-SIEMs-2_resources_apache_logs.txt - Apache attack logs
Resources/2-Homework_19-SIEMs-2_resources_apache_attack_logs.txt
Windows monitoring
- Signature, severity, status reports
- Failed activity alert
- Successful login alert
- Account deletion alert
- Windows monitoring dashboard
Apache monitoring
- Methods, referrers, response reports
- Non-US activity alert
- POST activity alert
- Apache monitoring dashboard
Splunk workspace
- Splunk environment
Other components
- SOC analyst
- SOC email recipient
Connections 19
- SOC analyst → Splunk environment: loads and analyzes
README.md - Windows server logs → Splunk environment: loads into
README.md - Windows attack logs → Splunk environment: loads into
README.md - Apache server logs → Splunk environment: loads into
README.md - Apache attack logs → Splunk environment: loads into
README.md - Splunk environment → Signature, severity, status reports: builds
README.md - Splunk environment → Failed activity alert: configures
README.md - Splunk environment → Successful login alert: configures
README.md - Splunk environment → Account deletion alert: configures
README.md - Splunk environment → Windows monitoring dashboard: builds
README.md - Splunk environment → Methods, referrers, response reports: builds
README.md - Splunk environment → Non-US activity alert: configures
README.md - Splunk environment → POST activity alert: configures
README.md - Splunk environment → Apache monitoring dashboard: builds
README.md - Failed activity alert → SOC email recipient: emails alert
README.md - Successful login alert → SOC email recipient: emails alert
README.md - Account deletion alert → SOC email recipient: emails alert
README.md - Non-US activity alert → SOC email recipient: emails alert
README.md - POST activity alert → SOC email recipient: emails alert
README.md