<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-splunk-correlation-searches
description: >-
  Design, implement, and tune Splunk correlation searches for threat detection.
  Covers SPL syntax, notable event creation, risk-based alerting, data models,
  and Enterprise Security correlation search workflows.
domain: cybersecurity
subdomain: blue-team
tags:
  - splunk
  - spl
  - correlation
  - siem
  - detection-engineering
  - enterprise-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1070"]
---

# Building Splunk Correlation Searches

## Overview

Splunk correlation searches combine multiple data sources and detection logic
to identify complex attack patterns. In Splunk Enterprise Security (ES), they
generate notable events for SOC triage. This skill covers SPL construction,
data model acceleration, risk-based alerting (RBA), and tuning strategies.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Splunk Enterprise or Cloud | Search platform |
| Splunk ES (optional) | Notable events and risk framework |
| CIM add-on | Common Information Model field normalization |
| Data model acceleration | Performance for `tstats` queries |

## Key Concepts

### SPL Fundamentals for Detection

```spl
// Basic search with stats
index=windows EventCode=4625
| stats count by src_ip, user
| where count > 10
| sort -count

// Subsearch correlation — failed then success from same IP
index=windows EventCode=4624
    [search index=windows EventCode=4625
     | stats count by src_ip
     | where count > 5
     | fields src_ip]
| stats values(user) as users, dc(user) as user_count by src_ip

// Transaction — group related events
index=windows (EventCode=4624 OR EventCode=4625)
| transaction src_ip maxspan=5m
| where eventcount > 10
| search EventCode=4624
```

### Data Model Accelerated Searches (tstats)

```spl
// Fast process creation search via CIM
| tstats summariesonly=true count from datamodel=Endpoint.Processes
  where Processes.process_name="powershell.exe"
  by Processes.dest, Processes.user, Processes.process, Processes.parent_process
| rename Processes.* as *

// Authentication failures via CIM
| tstats summariesonly=true count from datamodel=Authentication
  where Authentication.action="failure"
  by Authentication.src, Authentication.user, Authentication.dest
  | rename Authentication.* as *
  | where count > 20
```

### Risk-Based Alerting (RBA)

```spl
// Assign risk to an entity instead of creating notable directly
| tstats summariesonly=true count from datamodel=Endpoint.Processes
  where Processes.process_name="mimikatz.exe"
  by Processes.dest, Processes.user
| rename Processes.* as *
| eval risk_score=80
| eval risk_message="Mimikatz execution detected on " . dest
| collect index=risk marker="search_name=\"Mimikatz Execution\""
```

### Notable Event Creation

```spl
// Correlation search that creates notable events
index=windows EventCode=7045 Service_Type=kernel
| eval severity="high"
| eval rule_name="Suspicious Kernel Driver Installation"
| eval description="New kernel driver installed: " . Service_Name
| sendalert notable param.security_domain="endpoint"
    param.severity="high"
    param.rule_title="$rule_name$"
    param.rule_description="$description$"
```

### Lateral Movement Detection

```spl
// PsExec-style lateral movement
index=windows (EventCode=7045 Service_Name="PSEXESVC")
  OR (EventCode=4624 Logon_Type=3)
| stats values(EventCode) as events, dc(dest) as hop_count,
    values(dest) as destinations by src_ip, user
| where hop_count > 3
| sort -hop_count
```

### Lookup-Based Enrichment

```spl
// Enrich with threat intel
index=proxy
| lookup threat_intel_ip ip as dest_ip OUTPUT threat_category, confidence
| where isnotnull(threat_category)
| stats count by dest_ip, threat_category, confidence, src_ip
| sort -count
```

## Workflow

1. **Hypothesis** — Define threat behavior to detect (ATT&CK technique)
2. **Data source** — Identify index and sourcetype; verify CIM mapping
3. **Prototype** — Write initial SPL in search bar, test interactively
4. **Optimize** — Convert to `tstats` where possible for performance
5. **Correlate** — Add subsearches, lookups, or transactions for context
6. **Alert** — Configure as correlation search with notable event or risk score
7. **Tune** — Exclude known-good patterns, adjust thresholds from SOC feedback
8. **Document** — Record ATT&CK mapping, data requirements, FP patterns

## Detection

```yaml
title: Splunk Correlation Searches Detection
id: 719de3b4-0de1-429c-a075-8501f20e2a2e
status: experimental
description: Detects suspicious activity related to building splunk correlation searches techniques in blue team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*splunk*"
  condition: selection
level: medium
tags:
  - attack.t1070
  - attack.defense_evasion
falsepositives:
  - Security team running authorized detection validation tools
```

## Verification

| Check | Method |
|---|---|
| SPL syntax valid | Search runs without errors |
| Performance | Completes within scheduled window (typically < 5min) |
| Notable events fire | Test with known-bad data, verify in Incident Review |
| CIM fields populated | `\| datamodel Endpoint Processes search` returns data |
| Risk scores accurate | Risk index contains expected entries |

## References

- [Splunk SPL Reference](https://docs.splunk.com/Documentation/Splunk/latest/SearchReference)
- [Splunk ES Correlation Search Docs](https://docs.splunk.com/Documentation/ES)
- [Splunk Security Content](https://research.splunk.com/)
- [MITRE ATT&CK Splunk Mappings](https://github.com/splunk/security_content)
