Splunk Enterprise Security
Log and alert platforms (SIEM) — Splunk
What is this product?
A SIEM that collects logs from every system into one place and lets you search them with its own language, SPL. Alerts appear as Notable Events that an analyst works through one by one.
About the company
A US company founded in 2003 and acquired by Cisco in 2024. It became known for an engine that searches huge volumes of machine logs, then built a security-operations product on top of it.
What does an analyst do inside it?
- Opens the alert and reads the detection logic behind it.
- Searches the logs in SPL to pull every event tied to one host or user.
- Uses `| stats count by` to see which user or address repeats most.
- Writes the verdict, then closes or escalates the notable event.
Its search language
These examples are written in the syntax the product itself accepts.
- index=main host=FIN-WS-014
- index=main status=failure | stats count by user
The field names it uses
- sourcetype
- host
- user
- src_ip
- dest_ip
- action
- status
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
Very common in large enterprises and banks. SPL fluency is one of the most requested skills in SOC analyst job posts.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.