analyzing-windows-event-logs-in-splunk

【数据与研究】Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of …

独立 GitHub 快照 · 自动分类 · 以原作者文档为准