Splunk SOC Incident Triage Lab

Skills

• Splunk Enterprise
• SIEM
• Windows Security Event Logs
• SPL (Search Processing Language)
• Incident Response
• Security Event Analysis
• Tier 1 SOC Triage
• Windows Event IDs

Project Overview

This project simulates a Tier 1 Security Operations Center (SOC) investigation using Splunk Enterprise. Windows Security Event Logs were ingested into Splunk and analyzed using SPL (Search Processing Language) to investigate failed authentication attempts and privileged logon events.

Rather than simply searching logs, this investigation followed the standard Tier 1 SOC triage methodology by answering the following questions:

• Who performed the activity?
• What security event occurred?
• When did it happen?
• Where did it occur?
• How did the event happen?

The investigation concluded with an analyst assessment to determine whether the observed activity represented malicious behavior or normal Windows operating system activity.

Scenario

A security alert identified multiple failed Windows logon attempts on a workstation. As the assigned Tier 1 SOC Analyst, the objective was to investigate the alert, determine whether unauthorized activity had occurred, and decide if the incident required escalation.

Using Splunk Enterprise and Windows Security Event Logs, the investigation followed a structured triage process by identifying:

• Who initiated the activity
• What security events occurred
• When the events took place
• Where the events originated
• How the activity occurred

Based on the collected evidence, a final analyst assessment was made to determine whether the activity was malicious or expected system behavior.

Tools Used

• Splunk Enterprise

• Windows Security Event Logs

• Windows Event Viewer

• Search Processing Language (SPL)

• Skills Demonstrated

• Security Information and Event Management (SIEM)

• Security Event Analysis

• Windows Log Analysis

• Incident Triage

• Authentication Investigation

• Windows Event ID Analysis

• SPL Query Development

• Security Documentation

• Critical Thinking

• Investigation Objectives

The primary objectives of this investigation were to:

• Verify Windows Security Event Logs were successfully ingested into Splunk.
• Investigate failed authentication attempts (Event ID 4625).
• Review privileged logon events (Event ID 4672).
• Apply the Who, What, When, Where, and How triage methodology.
• Determine whether the observed activity was malicious or benign.
• Document the findings and provide a final analyst assessment.

SPL Queries Used

Failed Logon Investigation (Event ID 4625)

EventCode=4625

Privileged Logon Investigation (Event ID 4672)

EventCode=4672

Investigation Summary

index=* sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4672)
| stats count by EventCode

• Investigation Process

Step 1 – Launch Splunk Enterprise

Screenshot:

Opened Splunk Enterprise and accessed the Search & Reporting application to begin the investigation.

---

Step 2 – Verify Windows Security Log Ingestion

Screenshot:

Confirmed that Windows Security Event Logs were successfully ingested into Splunk and available for analysis.

---

Step 3 – Analyze Failed Logon Events (Event ID 4625)

Screenshot:

Queried Windows Security logs to identify failed authentication attempts and determine which accounts were affected.

---

Step 4 – Investigate Authentication Activity

Screenshot:

Reviewed failed logon events to identify patterns, affected accounts, and determine whether additional suspicious activity was present.

---

Step 5 – Review Privileged Logon Events (Event ID 4672)

Screenshot:

Investigated privileged logon events and confirmed the activity was associated with the Windows SYSTEM account, indicating expected operating system behavior rather than unauthorized privilege escalation.

---

Step 6 – Final Investigation Summary

Screenshot:

Reviewed the investigation results, correlated the collected evidence, and documented the final Tier 1 SOC analyst assessment.

Key Findings

• Successfully ingested Windows Security Event Logs into Splunk Enterprise.

• Identified failed logon attempts using Event ID 4625.

• Investigated privileged logon events using Event ID 4672.

• Applied the Who, What, When, Where, and How incident triage methodology.

• Determined the privileged activity was associated with the Windows SYSTEM account and represented expected operating system behavior.

• Found no evidence of unauthorized privilege escalation or account compromise during the investigation.

• Analyst Conclusion

This investigation followed a structured Tier 1 SOC incident triage process using Splunk Enterprise. By analyzing Windows Security Event Logs and answering the Who, What, When, Where, and How of the alert, the activity was determined to be benign.

Although failed logon attempts were observed, the privileged logon events were associated with the Windows SYSTEM account, which is expected operating system behavior. Based on the available evidence, no escalation beyond Tier 1 was required.

Lessons Learned

This project strengthened my understanding of how Tier 1 SOC analysts investigate Windows security events using Splunk Enterprise. Rather than focusing only on generating alerts, I learned to perform structured incident triage by identifying who performed the activity, what occurred, when it happened, where it originated, and how it occurred before making an analyst recommendation based on the available evidence.

This project demonstrates practical experience with SIEM log analysis, Windows event investigation, SPL querying, and structured incident triage.