Windows Security Log Analysis | SPL Queries | SOC Dashboard
This is a fully isolated, controlled lab environment. No real systems were targeted. All simulations performed on personal VMs for educational purposes only.
Lab 04 focuses on setting up a real SIEM using Splunk Cloud. Windows Security logs from the Windows 10 VM were exported using PowerShell, uploaded to Splunk Cloud, and analyzed using SPL queries. A SOC Security Monitoring Dashboard was created to visualize security events in real time — exactly what enterprise SOC analysts do daily.
| Component | Details |
|---|---|
| Hypervisor | VMware Workstation Pro 25H2 |
| Target Machine | Windows 10 x64 |
| SIEM Platform | Splunk Cloud Free Trial |
| Log Source | Windows Security Event Logs |
| Export Format | CSV via PowerShell |
| Total Events Ingested | 100 events |
| Account Monitored | Saro (DESKTOP-SDHF3AV) |
| Dashboard Created | SOC Security Monitoring Dashboard |
On Windows 10 VM — open PowerShell as Administrator and run:
Get-WinEvent -LogName Security -MaxEvents 200 |
Select-Object TimeCreated, Id, LevelDisplayName, Message |
Export-Csv -Path C:\Users\Public\Desktop\security-logs.csv -NoTypeInformation
Login to Splunk Cloud → Settings → Add Data → Upload → Select security-logs.csv → Source type: csv → Index: main → Submit
index=main | head 20
Result: 20 events confirmed ■ — Data successfully ingested into Splunk Cloud!
SPL (Search Processing Language) is the query language used in Splunk. These are the queries written and executed during Lab 04:
index=main | head 20
Result: 100 events found — confirmed successful upload
index=main | head 5 | table *
Result: Fields visible — TimeCreated, Id, LevelDisplayName, Message
index=main Message="logon" | table TimeCreated LevelDisplayName Message | head 20
Result: Logon events found and displayed
index=main Message="Saro" | table TimeCreated Message | head 20
Result: 90 events for account Saro detected!
index=main Message="credential" | stats count
Result: Credential Manager events counted
index=main Message="Saro" | stats count
Result: Count = 90 — used in SOC dashboard panel!
| Query | Purpose | Result |
|---|---|---|
| index=main head 20 | Verify data uploaded | 100 events found |
| index=main head 5 table * | Check field | All Fields visible |
| index=main Message=”logon” | Find login events | Logon events found |
| index=main Message=”Saro” | Account activity | 90 events detected |
| index=main Message=”credential” | Credential events | Events counted |
| index=main Message=”Saro” | Dashboard panel | Count 90 |
A custom SOC Security Monitoring Dashboard was created in Splunk Cloud with the following panels: Dashboard Panels Table:
| Panel Name | SPL Query | Result |
|---|---|---|
| Account Activity Monitor | index=main Message=”Saro” stats count | Count 90 events |
| Credential Event Count | index=main Message=”credential” stats count | Credential events monitored |
The dashboard showed 90 events for account Saro — in a real enterprise SOC this would trigger a User Behavior Analytics (UBA) alert for investigation!
| Finding | Details | Significance |
|---|---|---|
| Account Monitored | Saro on DESKTOP-SDHF3AV | Real account activity visible in SIEM |
| Total Events | 100 Windows Security events | Full log ingestion confirmed |
| Account Activity | 90 events for Saro | High activity — monitoring required |
| Credential Events | Multiple credential read events | Normal but worth monitoring |
| Security ID | S-1-5-21-1584132682 | User SID tracked in SIEM |
| Event Type | SuccessAudit | Successful operations logged |
| IOC Type | Value | Significance |
|---|---|---|
| Account Name | Saro | Primary monitored account |
| Machine Name | DESKTOP-SDHF3AV | Target Windows 10 machine |
| Event Count | 90 in short window | High frequency monitoring |
| Event Type | Credential Manager reads | Access pattern visible in SIEM |
| Log Source | security-logs.csv | Windows Security log export |
| SIEM Platform | Splunk Cloud | Industry standard SIEM |
• Real SIEM Experience — Splunk Cloud is used in 90% of enterprise SOCs. Having real hands-on Splunk experience immediately stands out in SOC analyst interviews.
• Account Activity Monitoring — 90 events for account Saro detected. In a real SOC this volume would trigger a User Behavior Analytics alert for investigation.
• Credential Manager Events — Multiple credential read events visible. Normal activity but SOC analysts monitor for unusual patterns that could indicate credential theft.
• SPL Query Skills — Written and executed multiple SPL queries to find specific events. This is the core daily skill of every Tier 1 SOC analyst.
• Dashboard Creation — Built SOC Security Monitoring Dashboard with live data panels. This is exactly what enterprise SOC analysts monitor daily.
| Lab | Kill Chain Stage | MITRE ATT&CK | Action |
|---|---|---|---|
| Lab 01 | Reconnaissance | T1046 — Network Service Discovery | Nmap found ports 135, 139, 445 |
| Lab 02 | Exploitation | T1110 — Brute Force | Metasploit attacked port 445 |
| Lab 03 | Reconnaissance + C2 | T1046 + T1071 | Traffic analysis with Wireshark |
| Lab 04 | Detection | T1078 — Valid Accounts | SIEM monitoring and log analysis |
• How to export Windows Security logs using PowerShell Get-WinEvent command.
• How to ingest log files into Splunk Cloud SIEM.
• How to write SPL queries to find specific security events.
• How to create a SOC monitoring dashboard in Splunk.
• How to monitor account activity and credential events in SIEM.
• How SIEM connects all previous lab findings into one detection platform.
• Real hands-on experience with industry standard SIEM tool — Splunk.
• How 90 events for one account can indicate suspicious behavior.
Saravanan — transitioning from Food Technology into Cybersecurity with a focus on SOC Analysis and Blue Team operations. This lab is part of my Mini SOC Home Lab series documenting hands-on learning.
- LinkedIn: linkedin.com/in/saravanan-cyber
- Email: career.entrydesk@gmail.com
- Location: Thiruvallur, Tamil Nadu, India
✅ If this lab helped you, give it a star!