Goal
Stand up Splunk in my homelab, send it logs from a Windows 10 host, generate attack traffic from a Kali Linux host, and write detections that catch common attack patterns.
This project is in progress, and I’m documenting it as I build it.
Lab layout
- Splunk as the SIEM, collecting and searching the logs
- Windows 10 as the monitored endpoint
- Kali Linux as the attacking machine
Having both sides in the same lab is the point. Every detection can be tested against real attack traffic I generated myself, so I know it fires when it should and stays quiet when it shouldn’t.
Where it came from
I first worked through an SSH brute-force investigation by hand, using grep and awk on raw logs. That taught me what the questions are: who is failing to log in, how often, against which accounts, and whether anything got through.
This lab is about turning those same questions into searches and alerts that run on their own. Having answered them by hand first, I know exactly what each detection is supposed to find.
What’s next
Detections will be added here as they’re written, each with the attack it targets, the search behind it, and whether it fired when tested from Kali.