Loading...
Loading...
Found 6 Skills
Splunk Enterprise and Enterprise Security SPL authoring for detection engineering — index/sourcetype/time discipline, tstats/CIM acceleration, ESCU macro layers, ES correlation searches, notables, and RBA. Use when authoring or reviewing SPL, configurations.splunk MDR blocks, ES correlation searches, or translating KQL hypotheses to Splunk. Pair with detection-engineering and opentide-detection-rule.
Author, explain, diagnose, and validate Splunk search-time field extractions and mappings to Common Information Model (CIM) datasets from representative events, configuration, and search evidence. Use for automatic key-value extraction, regex or delimiter extraction, props.conf EXTRACT and REPORT/transforms.conf rules, SPL extraction commands, aliases, calculated fields, lookups, event types, tags, value normalization, CIM field mapping, and missing or incorrect normalization; do not use for deployment execution, ingestion transport, app installation, knowledge-object governance, data-model acceleration, or unrelated search/dashboard repair.
Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.
Provide cited, read-only Splunk Enterprise administration guidance for routine local users, roles, capabilities, configuration precedence, service ownership, maintenance readiness, and safe non-mutating validation. Use when an administrator needs to understand documented Enterprise behavior, compare supplied source-file, btool, or runtime observations, identify accountable role owners, or decide what evidence is missing before a safe change. Route identity-provider authentication, knowledge-object governance, index/storage, app lifecycle, cluster operations, upgrade/security, health/diag, platform incidents, license/capacity, and deployment-server or forwarder-fleet work to their owning skills.
Give cited, advisory-only Splunk app and add-on lifecycle guidance and assess supplied compatibility, installation, upgrade, validation, deprecation, migration, and removal evidence. Use when a Splunk Cloud Platform or Splunk Enterprise administrator needs packaging or AppInspect guidance, environment-specific readiness classification, a non-mutating lifecycle plan, or safe-removal review for a named app/add-on and Splunk version. Route fact-only metadata lookup, platform upgrade execution, fleet rollout, vulnerability remediation, and knowledge-object governance beyond removal-impact checks to their owning workflows.
Microsoft Entra ID (formerly Azure AD) — identity platform internals, telemetry, and attack detection. Covers the full Entra ID surface including sign-in logs (interactive, non-interactive, service principal, managed identity), audit logs, Identity Protection risk signals, Conditional Access evaluation, directory role management, OAuth/consent grants, PRT/token mechanics, cross-tenant B2B/B2C, and workload identities. Includes SKU gating (P1 vs P2), ResultType code catalogue, identity attack patterns (password spray, AiTM, MFA fatigue, token theft, OAuth abuse, Golden SAML), and entity alignment for cross-platform correlation. Use for any work involving Entra ID telemetry, identity-focused detection, or directory security posture. Pair with the relevant platform skill for query mechanics (microsoft-sentinel, splunk-spl-processing, crowdstrike-falcon, etc.).