Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Splunk External Alerts

Generates a detection alert for each Splunk alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Splunk alerts in the app.

ATT&CK coverage

This detection is not mapped to any ATT&CK technique.

Detection requirements

Log source category: event_index

What the source says

References

https://docs.elastic.co/en/integrations/splunk

Tagged by the source as

Data Source: SplunkPromotion: External AlertsResources: Investigation GuideUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.