Security detection and incident investigation
Enterprise SOC Detection Lab
Simulate, detect, investigate, and tune.
The lab
A controlled three-VM Active Directory environment with Windows telemetry collected in Splunk. The public repository documents 14 simulations, 8 committed SPL detection files, and investigation reports.
DET-001 includes a false-positive tuning account for Splunk Universal Forwarder activity. Review the lab and its evidence.