Back to Details

splunk-spl-processing

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Splunk SPL — detection engineering

Splunk SPL — 检测工程

Author and review SPL for Splunk Enterprise / Enterprise Security. The discipline here mirrors the rigour applied to KQL in 
kusto-query-language
— filter early, structure deliberately, and document every assumption.
Pair with: 
windows-event-logs
(EventCode mapping), 
detection-engineering
(hunt→rule lifecycle), 
opentide-detection-rule
(
configurations.splunk
), 
kusto-query-language
(conceptual KQL translation).
Distilled from: Analysis of 2009 production detections, 234 macros, and 104 lookups in splunk/security_content (ESCU v5.26+).
为 Splunk Enterprise / Enterprise Security 编写和审查 SPL。这里的严谨程度与 
kusto-query-language
中对 KQL 的要求一致——尽早筛选、刻意组织结构，并记录每一项假设。
配合使用：
windows-event-logs
（EventCode 映射）、
detection-engineering
（hunt→rule 生命周期）、
opentide-detection-rule
（
configurations.splunk
）、
kusto-query-language
（概念层面的 KQL 转换）。
提炼自：对 splunk/security_content 中 2009 条生产检测、234 个宏和 104 个 lookup 的分析（ESCU v5.26+）。

1. Search-time discipline

1. 搜索时规范

1.1 Always lead with index, sourcetype, time

1.1 始终以 index、sourcetype、time 开头

Splunk searches without an 
index=
constraint scan default indexes — in production, there is often no default, so nothing is searched.
spl
index=wineventlog sourcetype="WinEventLog:Security" earliest=-7d@d latest=now
ConstructUse
index=
Primary partition — always include
sourcetype=
Schema-level filter
host=
, 
source=
Index-time fields — fast
earliest=
/ 
latest=
Event-time bound — prefer snapped (
-7d@d
)
_index_earliest
/ 
_index_latest
Index-time bound — late-arriving WEL from remote hosts
Full rejection checklist: 
references/Anti-Patterns.md
(AP-S1, AP-S2).
未使用 
index=
约束的 Splunk 搜索会扫描默认索引——在生产环境中通常不存在默认索引，因此不会搜索到任何内容。
spl
index=wineventlog sourcetype="WinEventLog:Security" earliest=-7d@d latest=now
结构用途
index=
主要分区——始终包含
sourcetype=
模式级筛选
host=
、
source=
索引时字段——速度快
earliest=
/ 
latest=
事件时间边界——优先使用对齐时间（
-7d@d
）
_index_earliest
/ 
_index_latest
索引时边界——用于来自远程主机的迟到 WEL
完整拒绝检查清单：
references/Anti-Patterns.md
（AP-S1、AP-S2）。

1.2 Indexed vs search-time fields

1.2 索引时字段与搜索时字段

Index-time (TSIDX — usable with 
tstats
): metadata fields plus anything in 
fields.conf
.
Search-time: everything else — extracted per event from 
props.conf
/ 
transforms.conf
.
Filter on index-time fields first; defer search-time parsing to the last possible moment.
spl
// GOOD
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688 TERM(encodedcommand) CommandLine="*-encodedcommand*"

// BAD
index=wineventlog EventCode=4688
| eval command=CommandLine
| where match(command, "-encodedcommand")
Leading wildcards (
*value
) cannot use tsidx alone — pair with 
TERM()
or 
PREFIX()
on known tokens (AP-S12). Example: 
TERM(mshta) TERM(exe) CommandLine="*\\mshta.exe"
.
索引时（TSIDX——可与 
tstats
配合使用）：元数据字段以及 
fields.conf
中的所有内容。
搜索时：其他所有内容——根据 
props.conf
/ 
transforms.conf
从每个事件中提取。
先筛选索引时字段；将搜索时解析推迟到尽可能晚的阶段。
spl
// GOOD
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688 TERM(encodedcommand) CommandLine="*-encodedcommand*"

// BAD
index=wineventlog EventCode=4688
| eval command=CommandLine
| where match(command, "-encodedcommand")
前导通配符（
*value
）无法单独利用 tsidx——应将已知 token 与 
TERM()
或 
PREFIX()
结合使用（AP-S12）。示例：
TERM(mshta) TERM(exe) CommandLine="*\\mshta.exe"
。

1.3 Streaming vs transforming commands

1.3 Streaming 与 Transforming 命令

Streaming (
eval
, 
where
, 
rex
, 
fields
) parallelises across indexers. Transforming (
stats
, 
chart
, 
timechart
, 
dedup
) collects to the search head.
spl
// GOOD: filter and project before stats
index=wineventlog EventCode=4688 TERM(encodedcommand) CommandLine="*-encodedcommand*"
| eval ParentName=lower(ParentImage)
| fields _time, host, User, CommandLine, ParentName
| stats count by host, ParentName
Streaming 命令（
eval
、
where
、
rex
、
fields
）可跨多个 indexer 并行执行。Transforming 命令（
stats
、
chart
、
timechart
、
dedup
）会将数据汇集到 search head。
spl
// GOOD: filter and project before stats
index=wineventlog EventCode=4688 TERM(encodedcommand) CommandLine="*-encodedcommand*"
| eval ParentName=lower(ParentImage)
| fields _time, host, User, CommandLine, ParentName
| stats count by host, ParentName

2. Schema authority — non-negotiable

2. Schema 权威性——不可妥协

Index names, sourcetypes, and CIM field availability are tenant-specific. Never assume 
index=wineventlog
or that CIM fields exist without verification.
Procedure before authoring 
tstats from datamodel=...
:
  1. Confirm sourcetype→CIM mapping via Technology Add-ons (TAs) in the target deployment.
  2. Verify data model acceleration in ES → Settings → Data Models.
  3. Smoke-test with 
    | tstats summariesonly=true count from datamodel=<Model> earliest=-1h
    .
  4. Zero results with known activity → broken mapping, not "no threats" (AP-S11).
For Windows 
EventCode=
filters, cross-reference 
windows-event-logs
— map Event IDs to tenant index/sourcetype via Layer 1 macros, not hardcoded indexes.
Load full CIM catalogue and TA prerequisites: 
references/CIM-Data-Models.md
.
索引名称、sourcetype 和 CIM 字段的可用性均取决于租户。在未经核实的情况下，切勿假定 
index=wineventlog
存在或 CIM 字段可用。
编写 
tstats from datamodel=...
前的流程：
  1. 通过目标部署中的 Technology Add-ons (TAs) 确认 sourcetype→CIM 映射。
  2. 在 ES → Settings → Data Models 中验证数据模型加速状态。
  3. 使用 
    | tstats summariesonly=true count from datamodel=<Model> earliest=-1h
    进行冒烟测试。
  4. 已知活动却得到零结果 → 映射已损坏，而不是“没有威胁”（AP-S11）。
对于 Windows 
EventCode=
筛选器，请交叉参考 
windows-event-logs
——通过 Layer 1 宏将 Event ID 映射到租户的 index/sourcetype，而不是硬编码索引。
加载完整的 CIM 目录和 TA 前置条件：
references/CIM-Data-Models.md
。

3. 
stats
vs 
tstats
vs 
streamstats
vs 
mstats

3. 
stats
vs 
tstats
vs 
streamstats
vs 
mstats

CommandSourceSpeedUse when
stats
Raw eventsSlowestFields not in tsidx / DM
tstats
TSIDX or accelerated CIM DM10–100× fasterIndex-time fields, 
TERM()
, accelerated models
streamstats
Streaming stateFastStateful per-event windows (beaconing, sequences)
mstats
Metrics indexes (MCatalog)Fast for metricsPre-aggregated numeric time series — not event indexes
spl
| tstats summariesonly=true count from datamodel=Endpoint.Processes
    where Processes.process_name=powershell.exe
    by Processes.dest, Processes.user
Always pair 
tstats
on accelerated data models with 
summariesonly=true
— without it, Splunk falls back to raw events for unaccelerated ranges.
mstats
details: 
references/Best-Practices.md
.
命令数据源速度使用场景
stats
原始事件最慢字段不在 tsidx / DM 中
tstats
TSIDX 或已加速的 CIM DM快 10–100 倍索引时字段、
TERM()
、已加速模型
streamstats
Streaming 状态快有状态的逐事件窗口（beaconing、sequence）
mstats
指标索引（MCatalog）对指标处理速度快预聚合的数值时间序列——不适用于事件索引
spl
| tstats summariesonly=true count from datamodel=Endpoint.Processes
    where Processes.process_name=powershell.exe
    by Processes.dest, Processes.user
对于已加速数据模型上的 
tstats
，务必搭配 
summariesonly=true
——否则，对于未加速的时间范围，Splunk 会回退到原始事件。
mstats
详情：
references/Best-Practices.md
。

4. Lookups, eventtypes, macros

4. Lookup、eventtype 与宏

Lookups

Lookup

spl
... | lookup threat_intel_feed indicator AS src_ip OUTPUT category, severity
Prefer 
lookup
/ 
inputlookup
over subsearches for IOC correlation (AP-S4).
spl
... | lookup threat_intel_feed indicator AS src_ip OUTPUT category, severity
对于 IOC 关联，优先使用 
lookup
/ 
inputlookup
，而不是 subsearch（AP-S4）。

Three-layer macro architecture

三层宏架构

Production frameworks (ESCU, OpenTide) use three layers for portability:
LayerSuffixPurpose
1 — Source
_logs
, 
_index
Index/sourcetype abstraction (
win_security_logs
, 
proxy_logs
)
2 — Process
process_*
Binary matching with anti-evasion (
process_name
+ 
original_file_name
)
3 — Filter
<detection>_filter
FP exclusions — empty by default (
search *
)
Principle: detections are write-once, deploy-anywhere. Customers tune macros, not core SPL.
Tenant content repos may ship 
references/macros.conf
— treat as authoritative override for Layer 1/2/3 definitions when present.
生产框架（ESCU、OpenTide）使用三层结构实现可移植性：
层级后缀用途
1 — Source
_logs
、
_index
index/sourcetype 抽象（
win_security_logs
、
proxy_logs
）
2 — Process
process_*
二进制匹配与反规避（
process_name
+ 
original_file_name
）
3 — Filter
<detection>_filter
FP 排除项——默认留空（
search *
）
原则：检测规则只需编写一次，即可随处部署。客户只调整宏，而不修改核心 SPL。
租户内容仓库可能附带 
references/macros.conf
——如果存在，应将其视为 Layer 1/2/3 定义的权威覆盖版本。

5. Canonical 
tstats
+ CIM pattern

5. 标准的 
tstats
+ CIM 模式

Single canonical block — detection variants in 
references/Detection-Type-Patterns.md
.
spl
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
  FROM datamodel=Endpoint.Processes
  WHERE <filter_conditions>
  BY Processes.dest, Processes.user, Processes.process_name, Processes.process, Processes.parent_process_name
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| <post_processing>
| `<detection_name>_filter`
ESCU vs OpenTide macro mapping: 
references/CIM-Data-Models.md
.
单一标准块——检测变体见 
references/Detection-Type-Patterns.md
。
spl
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
  FROM datamodel=Endpoint.Processes
  WHERE <filter_conditions>
  BY Processes.dest, Processes.user, Processes.process_name, Processes.process, Processes.parent_process_name
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| <post_processing>
| `<detection_name>_filter`
ESCU 与 OpenTide 宏映射：
references/CIM-Data-Models.md
。

6. Enterprise Security: correlation searches

6. Enterprise Security：关联搜索

Lifecycle

生命周期

  1. Hunting search validated ad-hoc.
  2. Saved as scheduled correlation search (typically 5–15 min, lookback aligned).
  3. Adaptive Response: notable (
    alert_action.notable
    ), risk boost (
    alert_action.risk
    ), TTP annotation.
  4. Tuning via thresholds, suppression, Layer 3 filter macros.
  5. RBA: low-fidelity signals aggregate per-entity risk; notables for high-fidelity or cumulative threshold breach.
  1. 经验证并临时执行的 Hunting search。
  2. 保存为定时关联搜索（通常为 5–15 分钟，并使回看期保持对齐）。
  3. Adaptive Response：notable（
    alert_action.notable
    ）、risk boost（
    alert_action.risk
    ）、TTP 标注。
  4. 通过阈值、suppression 和 Layer 3 filter 宏进行调优。
  5. RBA：低保真信号按实体聚合风险；高保真信号或累计阈值突破生成 notable。

Scheduled vs real-time constraints

定时与实时约束

ModeGuidance
ScheduledDefault. Supports heavy 
tstats
, summary indexes, long lookback. Align cron to lookback + ingestion lag.
Real-timeContinuous window (1–5 min). Avoid 
join
, large subsearches, unbounded 
values()
.
ThrottlingMandatory on production rules — set entity fields (
user
, 
src
, 
dest
) and duration.
模式指南
Scheduled默认方案。支持开销较大的 
tstats
、summary index 和较长回看期。将 cron 与回看期及摄取延迟对齐。
Real-time连续窗口（1–5 分钟）。避免使用 
join
、大型 subsearch 和无界 
values()
。
Throttling生产规则中必须启用——设置实体字段（
user
、
src
、
dest
）和持续时间。

Notable and RBA field shaping

Notable 与 RBA 字段塑形

spl
... | eval rule_name="Suspicious PowerShell Execution", severity=high, src=host, user=User, signature="T1059.001"
spl
... | eval risk_message="Unusual login from impossible-travel pair",
       risk_object=user, risk_object_type="user", risk_score=40,
       threat_object=src_ip, threat_object_type="ip_address"
Detection type shapes (TTP, Anomaly, Hunting, Correlation, Baseline): 
references/Detection-Type-Patterns.md
.
Common idioms (beaconing, impossible travel): 
references/SPL-Idioms.md
.
spl
... | eval rule_name="Suspicious PowerShell Execution", severity=high, src=host, user=User, signature="T1059.001"
spl
... | eval risk_message="Unusual login from impossible-travel pair",
       risk_object=user, risk_object_type="user", risk_score=40,
       threat_object=src_ip, threat_object_type="ip_address"
检测类型形态（TTP、Anomaly、Hunting、Correlation、Baseline）：
references/Detection-Type-Patterns.md
。
常用惯用法（beaconing、impossible travel）：
references/SPL-Idioms.md
。

7. False-positive engineering

7. 误报工程

Surface tuning knobs explicitly — align with Layer 3 filter macros for production, inline blocks for hunt iteration:
spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688 earliest=-7d@d
| where match(CommandLine, "(?i)-(enc|encodedcommand)")
``` --- BEGIN ENVIRONMENT FILTERS (move to Layer 3 filter macro for production) --- ```
| where NOT match(user, "(?i)^svc_")
| where NOT match(host, "(?i)^SCAN-")
``` --- END ENVIRONMENT FILTERS --- ```
| stats count by host, User, CommandLine
Production: migrate exclusions to 
`<detection_name>_filter`
macro. Hunting: inline filters acceptable with documented rationale.
显式呈现调优旋钮——生产环境应与 Layer 3 filter 宏保持一致，hunt 迭代时则可使用内联块：
spl
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688 earliest=-7d@d
| where match(CommandLine, "(?i)-(enc|encodedcommand)")
``` --- BEGIN ENVIRONMENT FILTERS (move to Layer 3 filter macro for production) ```
| where NOT match(user, "(?i)^svc_")
| where NOT match(host, "(?i)^SCAN-")
``` --- END ENVIRONMENT FILTERS ---
| stats count by host, User, CommandLine
生产环境：将排除项迁移到 
`<detection_name>_filter`
宏。Hunting：在记录依据的前提下，可以使用内联筛选器。

8. IOC query templates

8. IOC 查询模板

Replace index/sourcetype with tenant Layer 1 macros.
spl
// IP address — lookup enrichment
`proxy_logs` earliest=-30d
| lookup threat_intel_feed indicator AS dest_ip OUTPUT category, severity
| where isnotnull(category)
| table _time, src_ip, dest_ip, category, url

// Domain — base search + match
`dns_logs` earliest=-30d
| where match(query, "(?i)(malicious-domain\.example|bad-domain\.example)")

// Hash — process or file events
`endpoint_logs` earliest=-30d
| where sha256 IN ("<sha256_1>", "<sha256_2>")
| table _time, dest, user, file_name, sha256, process

// Base64-encoded PowerShell pipeline
`win_security_logs` EventCode=4688 earliest=-14d
| where match(CommandLine, "(?i)(-enc|-encodedcommand|-e )")
| rex field=CommandLine "(?i)-e(?:nc|ncodedcommand)?\s+(?<EncodedBlock>[^\s]+)"
| eval DecodedCommand=`base64decode(EncodedBlock)`
| where isnotnull(DecodedCommand)
| where match(DecodedCommand, "(?i)(IWR|DownloadString|IEX)")
将 index/sourcetype 替换为租户 Layer 1 宏。
spl
// IP address — lookup enrichment
`proxy_logs` earliest=-30d
| lookup threat_intel_feed indicator AS dest_ip OUTPUT category, severity
| where isnotnull(category)
| table _time, src_ip, dest_ip, category, url

// Domain — base search + match
`dns_logs` earliest=-30d
| where match(query, "(?i)(malicious-domain\\.example|bad-domain\\.example)")

// Hash — process or file events
`endpoint_logs` earliest=-30d
| where sha256 IN ("<sha256_1>", "<sha256_2>")
| table _time, dest, user, file_name, sha256, process

// Base64-encoded PowerShell pipeline
`win_security_logs` EventCode=4688 earliest=-14d
| where match(CommandLine, "(?i)(-enc|-encodedcommand|-e )")
| rex field=CommandLine "(?i)-e(?:nc|ncodedcommand)?\\s+(?<EncodedBlock>[^\\s]+)"
| eval DecodedCommand=`base64decode(EncodedBlock)`
| where isnotnull(DecodedCommand)
| where match(DecodedCommand, "(?i)(IWR|DownloadString|IEX)")

9. Rationale and precision/recall scoring

9. 依据说明与精确率/召回率评分

When SPL feeds hunt records or MDR 
description
/
response.procedure
, the rationale must answer:
  1. Why these indexes/sourcetypes? What captures the observable.
  2. Why these filters? Map each filter to intelligence or behavioural reasoning.
  3. What the query does NOT cover. Variants, evasion, scope exclusions.
  4. How results connect to the hypothesis. What a true positive proves.
ScorePrecision (FP volume in clean env)Recall risk
HIGH< 10 results; filters trace to specific intelNarrow filters; variants may evade
MEDIUM10–100; mix of specific + behaviouralKnown patterns covered; novel variants may evade
LOW> 100; broad behavioural patternBroad detection; harder to evade
当 SPL 为 hunt 记录或 MDR 
description
/
response.procedure
提供输入时，依据说明必须回答：
  1. 为什么使用这些 index/sourcetype？ 是什么捕获了可观测行为。
  2. 为什么使用这些筛选器？ 将每个筛选器与情报或行为推理对应起来。
  3. 查询未覆盖什么。 变体、规避方式、范围排除项。
  4. 结果如何与假设关联。 真正命中能够证明什么。
评分精确率（干净环境中的误报量）召回风险
HIGH少于 10 条结果；筛选器可追溯到具体情报筛选范围较窄；变体可能绕过
MEDIUM10–100 条；具体条件与行为条件混合覆盖已知模式；新型变体可能绕过
LOW超过 100 条；宽泛的行为模式检测范围广；更难规避

10. SPL vs KQL — conceptual translation

10. SPL 与 KQL——概念转换

KQLSPL
where TimeGenerated > ago(7d)
earliest=-7d@d
where Column has "value"
Column=*value*
or CIM tagged search
where Column == "value"
Column="value"
where Column in (a,b,c)
Column IN (a, b, c)
summarize count() by X, bin(Time, 5m)
bin _time span=5m | stats count by X, _time
summarize arg_max(Time, *) by Key
dedup Key sortby -_time
or 
stats latest(*) by Key
join kind=inner
Avoid — use 
lookup
, 
stats
, or accelerated DMs
materialize()
Summary indexing or 
tstats from datamodel=...
parse_json()
spath
extend
eval
let var = ...
Early 
eval
or saved macro
Comments 
//
Triple-backtick block comments (see §11 below)
Mindset shift: 
join
in SPL is expensive at scale. Prefer 
lookup
, union + 
stats
, or accelerated CIM data models.
KQLSPL
where TimeGenerated > ago(7d)
earliest=-7d@d
where Column has "value"
Column=*value*
或带 CIM tag 的搜索
where Column == "value"
Column="value"
where Column in (a,b,c)
Column IN (a, b, c)
summarize count() by X, bin(Time, 5m)
bin _time span=5m | stats count by X, _time
summarize arg_max(Time, *) by Key
dedup Key sortby -_time
或 
stats latest(*) by Key
join kind=inner
避免使用——改用 
lookup
、
stats
或已加速 DM
materialize()
Summary indexing 或 
tstats from datamodel=...
parse_json()
spath
extend
eval
let var = ...
前置 
eval
或已保存的宏
//
注释		三反引号块注释（参见下文 §11）
思维转变：SPL 中的 
join
在大规模场景下开销很高。优先使用 
lookup
、
union
+ 
stats
，或已加速的 CIM 数据模型。

11. Comment discipline

11. 注释规范

Splunk inline comments use triple backticks:
spl
``` Detection: Suspicious encoded PowerShell ```
``` Source: <reference> ```
``` MITRE: T1059.001 ```
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688 earliest=-7d@d
| where match(CommandLine, "(?i)-(enc|encodedcommand)")
| stats count by host, User, CommandLine
Apply the same header structure used in KQL (Hunt, Source, MITRE, Platform). Within OpenTide MDR objects, inline SPL headers may be reduced — metadata lives in MDR 
description
and alert templates.
Splunk 内联注释使用三反引号：
spl
``` Detection: Suspicious encoded PowerShell ```
``` Source: <reference> ```
``` MITRE: T1059.001 ```
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688 earliest=-7d@d
| where match(CommandLine, "(?i)-(enc|encodedcommand)")
| stats count by host, User, CommandLine
采用与 KQL 相同的头部结构（Hunt、Source、MITRE、Platform）。在 OpenTide MDR 对象中，可以精简 SPL 内联头部——元数据存放在 MDR 
description
和告警模板中。

12. Quality checklist

12. 质量检查清单

Universal

通用检查项

  • index=
    and 
    sourcetype=
    (or CIM tag / eventtype / Layer 1 
    *_logs
    macro) present.
  • Time bound via 
    earliest=
    / 
    latest=
    (or 
    _index_earliest
    /
    _index_latest
    for late-arriving data).
  • Streaming commands precede transforming commands.
  • tstats
    used when fields are in accelerated CIM DM or TSIDX; 
    summariesonly=true
    on DM queries.
  • drop_dm_object_name()
    applied after 
    tstats
    BY clause.
  • No 
    join
    — replaced with lookup, union + 
    stats
    , or accelerated DM.
  • Layer 1 
    *_logs
    / 
    *_index
    macros for index/sourcetype portability.
  • Process matching uses 
    process_name
    and 
    original_file_name
    where applicable.
  • Anomaly detections use 
    eventstats avg/stdev
    + documented threshold.
  • Suppression / throttling configured on correlation searches.
  • Notable / RBA fidelity choice deliberate and documented.
  • Detection type matches pattern in 
    references/Detection-Type-Patterns.md
    .
  • 存在 
    index=
    和 
    sourcetype=
    （或 CIM tag / eventtype / Layer 1 
    *_logs
    宏）。
  • 通过 
    earliest=
    / 
    latest=
    限定时间范围（迟到数据使用 
    _index_earliest
    /
    _index_latest
    ）。
  • Streaming 命令位于 Transforming 命令之前。
  • 当字段位于已加速的 CIM DM 或 TSIDX 中时使用 
    tstats
    ；DM 查询中设置 
    summariesonly=true
    。
  • 在 
    tstats
    的 BY 子句之后应用 
    drop_dm_object_name()
    。
  • 不使用 
    join
    ——改用 lookup、union + stats 或已加速 DM。
  • 使用 Layer 1 
    *_logs
    / 
    *_index
    宏实现 index/sourcetype 可移植性。
  • 适用时，进程匹配同时使用 
    process_name
    和 
    original_file_name
    。
  • 异常检测使用 
    eventstats avg/stdev
    并记录阈值。
  • 关联搜索已配置 suppression / throttling。
  • 有意识地选择并记录 notable / RBA 保真度。
  • 检测类型与 
    references/Detection-Type-Patterns.md
    中的模式一致。

ESCU / OpenTide macro conventions

ESCU / OpenTide 宏约定

  • `security_content_ctime()`
    (ESCU) or 
    `soc_macro_ctime_utc()`
    (OpenTide) applied to first/last time fields.
  • Layer 3 filter macro (
    `<detection_name>_filter`
    ) appended as last pipe.
  • Header comment block populated (or deferred to MDR metadata with rationale).
  • 已对 first/last time 字段应用 
    `security_content_ctime()`
    （ESCU）或 
    `soc_macro_ctime_utc()`
    （OpenTide）。
  • 最后一个管道已追加 Layer 3 filter 宏（
    `<detection_name>_filter`
    ）。
  • 已填充头部注释块（或推迟到 MDR 元数据并说明理由）。

13. Mapping into OpenTide MDR

13. 映射到 OpenTide MDR

When SPL is wired into 
configurations.splunk
in an OpenTide MDR object, coordinate with 
opentide-detection-rule
for schema fields:
MDR fieldSPL / ES alignment
query
SPL block scalar — follow this skill
threshold
Integer match count before alert
throttling.fields
/ 
throttling.duration
Entity dedup — mirror ES throttling
scheduling.cron
/ 
frequency
/ 
lookback
Align to ingestion lag and 
_index_earliest
where needed
notable.event.title
/ 
.description
$token$
field substitution
notable.drilldown.name
/ 
.search
Secondary investigation search
risk.risk_objects[]
field
, 
type
, 
score
— document score rationale (AP-S10)
risk.threat_objects[]
field
, 
type
(e.g. 
ip
, 
file_hash
)
Description, tuning narrative, severity, and response procedure → MDR 
description
and 
response.*
. Hunt-to-rule conversion: 
detection-engineering
.
将 SPL 接入 OpenTide MDR 对象的 
configurations.splunk
时，应与 
opentide-detection-rule
协调以下 schema 字段：
MDR 字段SPL / ES 对齐方式
query
SPL 块标量——遵循本 skill
threshold
触发告警前的整数匹配计数
throttling.fields
/ 
throttling.duration
实体去重——与 ES throttling 保持一致
scheduling.cron
/ 
frequency
/ 
lookback
与摄取延迟及需要时的 
_index_earliest
对齐
notable.event.title
/ 
.description
$token$
字段替换
notable.drilldown.name
/ 
.search
次要调查搜索
risk.risk_objects[]
field
、
type
、
score
——记录评分依据（AP-S10）
risk.threat_objects[]
field
、
type
（例如 
ip
、
file_hash
）
描述、调优说明、严重性和响应处置流程 → MDR 
description
和 
response.*
。Hunt 到规则的转换：
detection-engineering
。

14. Reference catalogues — load when…

14. 参考目录——需要时加载…

NeedFile
CIM model fields, TA prerequisites, macro mapping
references/CIM-Data-Models.md
TTP / Anomaly / Hunting / RBA / Baseline shapes
references/Detection-Type-Patterns.md
Beaconing, impossible travel, rare-process
references/SPL-Idioms.md
eval
/ 
stats
function lookup
references/Eval-and-Stats-Functions.md
TERM/PREFIX, subsearch limits, summary indexing, mstats, scheduling
references/Best-Practices.md
Rejection checklist AP-S1–S12
references/Anti-Patterns.md
需求文件
CIM 模型字段、TA 前置条件、宏映射
references/CIM-Data-Models.md
TTP / Anomaly / Hunting / RBA / Baseline 形态
references/Detection-Type-Patterns.md
Beaconing、impossible travel、rare-process
references/SPL-Idioms.md
eval
/ 
stats
函数查询
references/Eval-and-Stats-Functions.md
TERM/PREFIX、subsearch 限制、summary indexing、mstats、scheduling
references/Best-Practices.md
拒绝检查清单 AP-S1–S12
references/Anti-Patterns.md