Category: Tutorial
-
Building a Threat Intelligence Dashboard in Splunk with AlienVault OTX
For the ECA Cyber Range Splunk Security Dashboard Challenge, I built a CTI dashboard that correlates AlienVault OTX threat intelligence against live Sysmon endpoint telemetry. The idea is simple. OTX publishes malicious IPs, domains, file hashes, and adversary TTPs. Sysmon captures everything happening on your Windows endpoints. The dashboard joins those two data sources and…
-
Installing a NIDS on a Raspberry PI 4 with Splunk Dashboard
Over the weekend, I noticed I had a spare Raspberry Pi lying around (actually, several PIs) and installed Suricata as a NIDS on it. This is a fresh install of Ubuntu 25.10 on a Raspberry PI 4B 4 GB sudo apt update sudo apt upgrade sudo apt install -y suricata suricata -V Edit /etc/suricata/suricata.json Put…