New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Building Detection Rule With Splunk Spl

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.

Apache-2.0Auto-check passedSecurity

Install Building Detection Rule With Splunk Spl

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-detection-rule-with-splunk-spl -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills building-detection-rule-with-splunk-spl --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/building-detection-rule-with-splunk-spl .claude/skills/building-detection-rule-with-splunk-spl && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
building-detection-rule-with-splunk-spl
GitHub stars
34k
Token cost
~2.7k tokens
SKILL.md length
471 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.

  • Works in 6 steps: Threshold-Based Detection → Sequence-Based Detection (Failed Login… → Anomaly Detection with Baseline Comparison → …
  • Security work in your project
  • SKILL.md covers Overview, When to Use, Prerequisites and Core SPL Detection Rule Patterns, plus 5 more sections
  • Runs Python scripts from its folder

What it does

Building Detection Rule With Splunk Spl is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.

Its SKILL.md is about 2.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security. It works with Splunk. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Security work in your project

Example prompts

  • “/building-detection-rule-with-splunk-spl”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Threshold-Based Detection
  2. Sequence-Based Detection (Failed Login Followed by Success)
  3. Anomaly Detection with Baseline Comparison
  4. Lateral Movement Detection
  5. Data Exfiltration Detection
  6. PowerShell Suspicious Execution Detection

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • detect.fyi
    • medium.com
    • help.splunk.com
    • socprime.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Building Detection Rule With Splunk Spl loads about 2.7k tokens when it runs, and up to ~4.2k if it reads all its reference files. Until then it costs about 47 tokens; SKILL.md has 471 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~47
When it runs · the whole SKILL.md, loaded when a task matches
~2.7k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 471 words, ~2,673 tokens.

Download SKILL.mdSave it as .claude/skills/building-detection-rule-with-splunk-spl/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
building-detection-rule-with-splunk-spl
description
Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.
domain
cybersecurity
subdomain
soc-operations
tags
splunk, spl, detection-engineering, correlation-search, siem, soc, threat-detection, enterprise-security
version
1.0
author
mahipal
license
Apache-2.0
d3fend_techniques
Executable Denylisting, Execution Isolation, File Metadata Consistency Validation, Content Format Conversion, File Content Analysis
nist_csf
DE.CM-01, DE.AE-02, RS.MA-01, DE.AE-06
mitre_attack
T1059.001, T1003.001, T1021.002, T1110.003, T1053.005, T1048

Building Detection Rules with Splunk SPL

Overview

Splunk Search Processing Language (SPL) is the primary query language used in Splunk Enterprise Security for building correlation searches that detect suspicious events and patterns. A well-crafted detection rule aggregates, correlates, and enriches security events to generate actionable notable events for SOC analysts. Enterprise SIEMs on average cover only 21% of MITRE ATT&CK techniques, making skilled SPL rule writing essential for closing detection gaps.

When to Use

  • When deploying or configuring building detection rule with splunk spl capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Splunk Enterprise Security (ES) deployed and configured
  • Access to Splunk Search & Reporting app with appropriate roles
  • Understanding of Common Information Model (CIM) data models
  • Familiarity with MITRE ATT&CK framework techniques
  • Knowledge of the organization's log sources and data flows

Core SPL Detection Rule Patterns

1. Threshold-Based Detection

Detects events exceeding a defined count within a time window.

spl
index=wineventlog sourcetype=WinEventLog:Security EventCode=4625
| stats count as failed_logins dc(TargetUserName) as unique_users by src_ip
| where failed_logins > 10 AND unique_users > 3
| eval severity="high"
| eval description="Brute force attack detected from ".src_ip." with ".failed_logins." failed logins across ".unique_users." accounts"
2. Sequence-Based Detection (Failed Login Followed by Success)

Correlates a sequence of events indicating a successful brute force attack.

spl
index=wineventlog sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624)
| eval login_status=case(EventCode=4625, "failure", EventCode=4624, "success")
| stats count(eval(login_status="failure")) as failures count(eval(login_status="success")) as successes latest(_time) as last_event by src_ip, TargetUserName
| where failures > 5 AND successes > 0
| eval description="Account ".TargetUserName." compromised via brute force from ".src_ip
| eval urgency="critical"
3. Anomaly Detection with Baseline Comparison

Compares current activity against a baseline period to detect spikes.

spl
index=proxy sourcetype=squid
| bin _time span=1h
| stats count as current_count by src_ip, _time
| join src_ip type=left [
    search index=proxy sourcetype=squid earliest=-7d@d latest=-1d@d
    | stats avg(count) as avg_count stdev(count) as stdev_count by src_ip
]
| eval threshold=avg_count + (3 * stdev_count)
| where current_count > threshold
| eval deviation=round((current_count - avg_count) / stdev_count, 2)
| eval description="Anomalous web traffic from ".src_ip." - ".deviation." standard deviations above baseline"
4. Lateral Movement Detection

Identifies potential lateral movement using Windows logon events.

spl
index=wineventlog sourcetype=WinEventLog:Security EventCode=4624 Logon_Type=3
| where NOT match(TargetUserName, ".*\$$")
| stats dc(dest) as unique_hosts values(dest) as hosts by src_ip, TargetUserName
| where unique_hosts > 5
| eval severity=case(unique_hosts > 20, "critical", unique_hosts > 10, "high", true(), "medium")
| eval description=TargetUserName." accessed ".unique_hosts." unique hosts from ".src_ip." via network logon"
5. Data Exfiltration Detection

Monitors for large outbound data transfers.

spl
index=firewall sourcetype=pan:traffic action=allowed direction=outbound
| stats sum(bytes_out) as total_bytes_out dc(dest_ip) as unique_destinations by src_ip, user
| eval total_mb=round(total_bytes_out/1048576, 2)
| where total_mb > 500 OR unique_destinations > 50
| lookup asset_lookup ip as src_ip OUTPUT asset_category, asset_owner
| eval severity=case(total_mb > 2000, "critical", total_mb > 1000, "high", true(), "medium")
| eval description=user." transferred ".total_mb."MB to ".unique_destinations." unique destinations"
6. PowerShell Suspicious Execution Detection

Detects encoded or obfuscated PowerShell commands.

spl
index=wineventlog sourcetype=WinEventLog:Security EventCode=4104
| where match(ScriptBlockText, "(?i)(encodedcommand|invoke-expression|iex|downloadstring|frombase64string|net\.webclient|invoke-webrequest|bitstransfer|invoke-mimikatz|invoke-shellcode)")
| eval decoded_length=len(ScriptBlockText)
| stats count values(ScriptBlockText) as commands by Computer, UserName
| where count > 0
| eval severity="high"
| eval mitre_technique="T1059.001"
| eval description="Suspicious PowerShell execution on ".Computer." by ".UserName

Building Correlation Searches in Splunk ES

Show full SKILL.md (226 more words)Show less
Step-by-Step Process
  1. Define the Use Case: Map to MITRE ATT&CK technique and define what behavior to detect
  2. Identify Data Sources: Determine which indexes and sourcetypes contain relevant events
  3. Write the Base Search: Build SPL that extracts relevant events
  4. Add Aggregation: Use stats, eventstats, or streamstats to summarize
  5. Apply Thresholds: Set conditions with where clause that distinguish normal from anomalous
  6. Enrich Context: Add lookups for asset information, identity data, and threat intelligence
  7. Configure Notable Event: Set severity, urgency, and description fields
  8. Schedule and Test: Run against historical data and validate detection accuracy
Correlation Search Configuration Template
spl
| tstats summariesonly=true count from datamodel=Authentication
    where Authentication.action=failure
    by Authentication.src, Authentication.user, _time span=5m
| rename "Authentication.*" as *
| stats count as total_failures dc(user) as unique_users values(user) as targeted_users by src
| where total_failures > 20 AND unique_users > 5
| lookup dnslookup clientip as src OUTPUT clienthost as src_dns
| lookup asset_lookup ip as src OUTPUT priority as asset_priority, category as asset_category
| eval urgency=case(asset_priority=="critical", "critical", asset_priority=="high", "high", true(), "medium")
| eval rule_name="Brute Force Against Multiple Accounts"
| eval rule_description="Multiple authentication failures from ".src." targeting ".unique_users." unique accounts"
| eval mitre_attack="T1110.001 - Password Guessing"
Enrichment Best Practices
spl
| lookup identity_lookup identity as user OUTPUT department, manager, risk_score as user_risk
| lookup asset_lookup ip as src_ip OUTPUT asset_name, asset_category, asset_priority, asset_owner
| lookup threatintel_lookup ip as src_ip OUTPUT threat_type, threat_confidence, threat_source
| eval context=case(
    isnotnull(threat_type), "Known threat: ".threat_type,
    user_risk > 80, "High-risk user: risk score ".user_risk,
    asset_priority=="critical", "Critical asset: ".asset_name,
    true(), "Standard context"
)

Performance Optimization

Use Data Models with tstats
spl
| tstats summariesonly=true count from datamodel=Network_Traffic
    where All_Traffic.action=allowed
    by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.dest_port, _time span=1h
| rename "All_Traffic.*" as *
Limit Time Ranges and Use Indexed Fields
spl
index=wineventlog source="WinEventLog:Security" EventCode=4688
    earliest=-15m latest=now()
| where NOT match(New_Process_Name, "(?i)(svchost|csrss|lsass|services)")
Use Summary Indexing for Historical Baselines
spl
| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src, _time span=1h
| collect index=summary source="auth_failure_baseline" marker="report_name=auth_failure_hourly"

Testing and Validation

Test Against Known Attack Patterns
spl
| makeresults count=1
| eval src_ip="10.0.0.50", failed_logins=25, unique_users=8, severity="high"
| eval description="Test brute force detection"
| append [
    search index=wineventlog sourcetype=WinEventLog:Security EventCode=4625
    earliest=-24h latest=now()
    | stats count as failed_logins dc(TargetUserName) as unique_users by src_ip
    | where failed_logins > 10 AND unique_users > 3
    | eval severity="high"
]
Calculate Detection Metrics
spl
index=notable
| search rule_name="Brute Force*"
| stats count as total_alerts count(eval(status_label="Closed - True Positive")) as true_positives count(eval(status_label="Closed - False Positive")) as false_positives by rule_name
| eval precision=round(true_positives / (true_positives + false_positives) * 100, 2)
| eval fpr=round(false_positives / total_alerts * 100, 2)

MITRE ATT&CK Mapping

Technique IDTechnique NameSPL Detection Approach
T1110.001Password GuessingThreshold on EventCode 4625 by src_ip
T1059.001PowerShellPattern match on EventCode 4104 ScriptBlockText
T1021.002SMB/Windows Admin SharesLogon Type 3 with dc(dest) threshold
T1048Exfiltration Over C2bytes_out aggregation over time window
T1053.005Scheduled TaskEventCode 4698 with suspicious command patterns
T1003.001LSASS MemoryProcess access to lsass.exe via Sysmon EventCode 10

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/building-detection-rule-with-splunk-spl of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Building Detection Rule With Splunk Spl next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Building Detection Rule With Splunk Spl compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Building Detection Rule With Splunk Spl this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2.7kAutomated safety check: PassApache-2.0
Detection SigmaAgentSecOps/SecOpsAgentKit2201 repos~4kAutomated safety check: PassCustom licence
Siem Detectionbriiirussell/cybersecurity-skills413—~2.6kAutomated safety check: NotesMIT
Doca ArgusNVIDIA/skills3.6k—~4.8kAutomated safety check: PassApache-2.0
Hunting Threatstrilwu/secskills157—~3.5kAutomated safety check: PassMIT
Siem Loggingancoleman/ai-design-components525—~3.4kAutomated safety check: PassMIT

Similar skills

  • Detection Sigma

    AgentSecOps/SecOpsAgentKit

    Generic detection rule creation and management using Sigma, the universal SIEM rule format.

    220 GitHub starsUsed in 1 repo~4k tokens
    SecurityAuto-check passed

  • Siem Detection

    briiirussell/cybersecurity-skills

    Engineer and audit SIEM detection rules — log source coverage, Sigma / KQL / SPL / Elastic query authoring, MITRE ATT&CK mapping, false-positive tuning, and detection-as-code workflows.

    413 GitHub stars~2.6k tokensUpdated 4 mo ago
    SecurityAuto-check: notes

  • Doca Argus

    NVIDIA/skills

    Official

    A skill your agent uses when the user is deploying or operating the DOCA Argus Service — the packaged BlueField-side runtime-security container that watches the BlueField and attached host for…

    3.6k GitHub stars~4.8k tokensUpdated yesterday
    SecurityAuto-check passed

  • Hunting Threats

    trilwu/secskills

    Run hypothesis-driven threat hunts across endpoint, network, cloud, and identity telemetry using stack counting, outlier analysis, and ATT&CK-based hypotheses, with SIEM query patterns for Splunk…

    157 GitHub stars~3.5k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Siem Logging

    ancoleman/ai-design-components

    Configure security information and event management (SIEM) systems for threat detection, log aggregation, and compliance.

    525 GitHub stars~3.4k tokensUpdated 10 mo ago
    SecurityAuto-check passed

  • Breach Forensics

    mukul975/Privacy-Data-Protection-Skills

    Conducts digital forensics investigations following a personal data breach, covering evidence preservation, chain of custody documentation, log analysis, scope determination, and root cause analysis.

    301 GitHub stars~3.1k tokensUpdated 6 mo ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Building Detection Rule With Splunk Spl

What does Building Detection Rule With Splunk Spl do?

Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments. Building Detection Rule With Splunk Spl is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.

When should I use Building Detection Rule With Splunk Spl?

Building Detection Rule With Splunk Spl fits situations like: security work in your project.

How do I install Building Detection Rule With Splunk Spl in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-detection-rule-with-splunk-spl -a claude-code`. Or copy the skill folder (skills/building-detection-rule-with-splunk-spl in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/building-detection-rule-with-splunk-spl in your project. Claude Code loads it when a task matches its description.

How do I install Building Detection Rule With Splunk Spl in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-detection-rule-with-splunk-spl -a codex`. Or copy the skill folder (skills/building-detection-rule-with-splunk-spl in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/building-detection-rule-with-splunk-spl in your project. Codex loads it when a task matches its description.

Can I use Building Detection Rule With Splunk Spl in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-detection-rule-with-splunk-spl -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/building-detection-rule-with-splunk-spl, .gemini/skills/building-detection-rule-with-splunk-spl, .github/skills/building-detection-rule-with-splunk-spl and .opencode/skills/building-detection-rule-with-splunk-spl in your project.

What does Building Detection Rule With Splunk Spl need to run?

Going by SKILL.md and its folder, Building Detection Rule With Splunk Spl needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Building Detection Rule With Splunk Spl access the network?

SKILL.md names 4 domains. As links in the text: detect.fyi, medium.com, help.splunk.com and socprime.com. This is read from the text; nothing was executed.

Is Building Detection Rule With Splunk Spl safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Building Detection Rule With Splunk Spl use?

Building Detection Rule With Splunk Spl is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Building Detection Rule With Splunk Spl use?

About 2.7k tokens (SKILL.md is roughly 11k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.5k tokens, read only when the agent opens those files.

What are the alternatives to Building Detection Rule With Splunk Spl?

Skills that share tags, products or a category with Building Detection Rule With Splunk Spl: Detection Sigma (AgentSecOps/SecOpsAgentKit, 220 stars), Siem Detection (briiirussell/cybersecurity-skills, 413 stars), Doca Argus (NVIDIA/skills, 3.6k stars) and Hunting Threats (trilwu/secskills, 157 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Building Detection Rule With Splunk Spl?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.