SPL Searches

Searches grouped by purpose. Each one lists what it does and the SPL to adapt to your data.

Page	What's Inside
Detections	Reusable detections for authentication, network, malware, log integrity, and operations
Web and HTTP Analysis	Searches against web and HTTP stream data: injection, enumeration, and traffic analysis
Investigations (BOTS)	End-to-end investigation walkthroughs against the Boss of the SOC datasets

Adapt before you run

Index names, sourcetypes, and fields vary by environment. Swap the index=, sourcetype=, and field names for the ones your data uses before running any of these.