Skip to content
Get packs

Splunk SPL Detection Rules

Lets an agent draft Splunk SPL correlation searches that flag security threats for SOC analysts.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill teaches an AI agent how to write Splunk search queries (SPL) that act as security detection rules, the kind a Security Operations Center uses to spot attacks in logs. Once installed, the agent can produce example rules for patterns such as brute-force logins, lateral movement, data exfiltration, and suspicious PowerShell, each mapped to MITRE ATT&CK techniques, and can suggest the steps to schedule and test them. The included Python scripts generate and score rule templates, but the rules still need to be run and checked against your own Splunk data.

Great for

  • Detection engineers or SOC analysts who already use Splunk Enterprise Security and want starting-point correlation searches
  • Security teams mapping existing detections to MITRE ATT&CK coverage
  • Students learning how SPL aggregates and correlates security events

Skip it if

  • Teams without Splunk Enterprise Security, since the rules and data models assume it and will not run elsewhere without changes
  • Production use without review: the example thresholds and index/sourcetype names (for example index=main, count > 10) are generic and can cause false positives or missed attacks in a real environment
  • Non-security users, because the output assumes knowledge of log sources, CIM data models and attack behaviour

Try asking

  • “Write a Splunk correlation search that detects failed logins followed by a successful login from the same source IP”
  • “Build an SPL rule for PowerShell encoded command execution and map it to MITRE T1059.001”
  • “Create a data exfiltration detection that flags large outbound transfers per user from firewall logs”
  • “Give me a step-by-step plan to test a brute-force detection rule against historical Splunk data”
Step-by-step guide: how to use Splunk SPL Detection RulesInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    building-detection-rule-with-splunk-spl.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-detection-rule-with-splunk-spl.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-detection-rule-with-splunk-spl.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Replace the generic index, sourcetype and threshold values with ones from your own environment and tune them against historical data before enabling alerts
  • Review the Python scripts before running them, since scripts/agent.py imports requests and the agent may execute them
  • Ask the agent to explain each where-clause threshold so you can judge false-positive risk before deploying

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.