Investigating with Splunk (TryHackMe)

Completed a hands-on security investigation project using Splunk to analyze machine-generated data, identify security events, and investigate potential threats. Utilized Splunk Search Processing Language (SPL) to search, correlate, and interpret log data from multiple sources, supporting incident detection and response activities.

Key Responsibilities & Accomplishments

Imported and analyzed system, network, and security logs within Splunk.
Used SPL queries to investigate suspicious events, authentication activity, and potential indicators of compromise (IOCs).
Correlated events from multiple data sources to identify patterns and reconstruct security incidents.
Created dashboards, reports, and visualizations to monitor security events and system activity.
Investigated failed login attempts, privilege escalation events, malware indicators, and anomalous user behavior.
Leveraged Splunk fields, filters, and statistical commands to perform efficient data analysis and threat hunting.
Documented investigative findings and provided recommendations for remediation and security improvements.
Applied security monitoring and incident response methodologies to support a Security Operations Center (SOC) workflow.

Skills & Technologies

Splunk Enterprise
Search Processing Language (SPL)
Security Monitoring
Log Analysis
Threat Hunting
Incident Investigation
SIEM Operations
Cybersecurity Analysis
Data Correlation & Visualization
Security Event Management