Skip to content
Get packs

Guide · Agent skill

How to use the Splunk SPL Detection Rules agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the building-detection-rule-with-splunk-spl agent skill, which helps an AI agent write Splunk SPL queries that work as security correlation searches. It is written for people who may never have used an agent skill before. By the end you will know what the skill does, how to add it to your agent, how to ask for rules, and what to check before any rule goes into production.

Splunk SPL Detection Rulesmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the skill ZIP from this directory page. Keep the file name as it is.
  2. 2Install the skill. Unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ in a project. Alternatively, upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
  3. 3Confirm the prerequisites. Check that Splunk Enterprise Security is deployed, you can use Search & Reporting, and Python 3 with requests is available if you plan to run the scripts.
  4. 4Ask for a rule. Describe one detection in plain language, naming the behaviour, the log source and the MITRE ATT&CK technique if you know it.
  5. 5Review the SPL. Read the query line by line. Replace generic index, sourcetype and threshold values with your own, and confirm the fields exist in your data.
  6. 6Test against historical data. Run the search over past data and check how many results it returns, and whether the results are real attacks or normal activity.
  7. 7Schedule and tune. Once the results look right, schedule the search and adjust thresholds to reduce false positives before moving it to production.

What this skill makes the agent do

A Security Operations Center uses detection rules to spot attacks in log data. In Splunk Enterprise Security these rules are written as SPL (Search Processing Language) correlation searches that aggregate and correlate events and produce notable events for analysts. This skill teaches the agent how to write those searches.

Once installed, the agent can produce example rules for patterns such as brute-force logins, lateral movement, data exfiltration and suspicious PowerShell. Each example is mapped to MITRE ATT&CK techniques, and the agent can suggest steps for scheduling and testing the rule. The skill also includes a rule template and reference material on Splunk's Common Information Model (CIM) data models and Windows Event IDs.

  • Threshold-based detection, such as many failed logins from one source
  • Sequence detection, such as failed logins followed by a success
  • Anomaly detection against a seven-day baseline
  • Lateral movement, data exfiltration and suspicious PowerShell patterns

How to install the skill

Download the skill ZIP from the skill's page on this directory. Then choose one of the two install routes below.

For a personal install, unzip the file into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

After installing, check that the skill folder contains SKILL.md, the assets and references folders, and the scripts folder.

  • Personal install: unzip into ~/.claude/skills/
  • Project install: unzip into .claude/skills/ inside your project
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP
~/.claude/skills/

What you need before you start

The skill assumes a working Splunk environment. Splunk Enterprise Security (ES) must be deployed and configured, because the correlation searches and notable events depend on it. You also need access to the Splunk Search & Reporting app with roles that let you run searches.

The skill's prerequisites also expect you to understand CIM data models, the MITRE ATT&CK framework, and your organisation's log sources and data flows. The agent's output is only as useful as that knowledge on your side.

  • Splunk Enterprise Security deployed and configured
  • Access to the Splunk Search & Reporting app with appropriate roles
  • Familiarity with CIM data models and MITRE ATT&CK
  • Python 3 with the requests library, used by scripts/agent.py

How to trigger the skill with natural requests

You do not need a special command. Describe the detection you want in plain language and name the data source if you know it. The agent should pick up the skill from the request and use its patterns and template.

Be specific about the behaviour, the log source and the output you need. Mentioning MITRE ATT&CK technique IDs helps the agent map the rule correctly.

  • Write a Splunk correlation search for brute-force logins against multiple accounts, mapped to MITRE ATT&CK.
  • Draft an SPL detection rule for lateral movement using Windows logon events, Logon_Type 3.
  • Give me a tstats-based data exfiltration rule using the Network_Traffic data model and a severity for each result.
  • Turn this PowerShell detection idea into a scheduled correlation search and list how to test it against historical data.

Example: a simple threshold rule

The simplest pattern counts failed Windows logons per source and flags sources that exceed a threshold. The example below is taken from the skill. Its thresholds and index names are generic, so change them to match your environment before use.

The skill also shows how to add lookups for asset and identity context, set severity and urgency fields, and build a description string for each notable event.

index=wineventlog sourcetype=WinEventLog:Security EventCode=4625 | stats count as failed_logins dc(TargetUserName) as unique_users by src_ip | where failed_logins > 10 AND unique_users > 3 | eval severity="high"

Safety notes: scripts and network use

This skill includes Python scripts. scripts/process.py generates and scores rule templates, and scripts/agent.py uses the requests library. The skill metadata lists the scripts as running, but network use as none. Read both scripts before running them, and check any network calls they make in your own environment.

The rules themselves are not validated by the scripts. They must be run and checked against your own Splunk data before anyone relies on them. The example thresholds and index names can cause false positives or missed attacks if used unchanged.

  • Review scripts/agent.py and scripts/process.py before running them
  • Run the rules only in a test or lab Splunk instance first
  • Do not rely on generic thresholds such as count > 10 without tuning

Tips for getting useful output

Give the agent your real index and sourcetype names, and say which CIM data models you use. Ask for the rule to be tested against historical data before scheduling. Keep the MITRE ATT&CK mapping in the output so coverage can be tracked later.

The skill's reference files cover the saved search fields used for scheduling, a list of common SPL commands, and standards such as NIST SP 800-61 Rev 2 and NIST SP 800-92. Ask the agent to point to these when you need them.

  • Name your real indexes and sourcetypes
  • State which CIM data models are in use
  • Ask for a test plan against historical data before scheduling
  • Keep the MITRE ATT&CK technique IDs in the output

What people use it for

  • Drafting a brute-force correlation search that flags a source with many failed logins and a few accounts targeted.
  • Creating a lateral movement rule from Windows logon events that counts unique hosts reached by one account.
  • Building a data exfiltration search over firewall traffic that sums outbound bytes per user and checks asset context.
  • Producing a set of starter rules, each mapped to a MITRE ATT&CK technique, to review for coverage gaps.

Frequently asked questions

How do I install the Splunk SPL Detection Rules agent skill?

Download the skill ZIP from this directory page. Unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

What do I need to use this skill?

You need Splunk Enterprise Security deployed, access to the Splunk Search & Reporting app with suitable roles, and Python 3 with the requests library if you run the included scripts. You should also understand CIM data models and MITRE ATT&CK.

Is the Splunk SPL Detection Rules skill free to use?

The skill is licensed under Apache-2.0, as stated on this page. Splunk Enterprise Security itself is a separate product and needs its own licence.

Can I use this skill without Splunk Enterprise Security?

The source says the rules and data models assume Splunk Enterprise Security and will not run elsewhere without changes. Teams without it should expect to adapt the searches significantly.

Why do my generated rules return no results or too many results?

The example index and sourcetype names and thresholds are generic. Check that your index and sourcetype names match your data, that the fields exist, and that the thresholds suit your environment. Tuning against historical data is the usual fix.

How does this skill compare with other detection tools?

This page does not compare it with other tools. Judge it by whether the rules it writes match your own log sources and detection standards, and whether they pass testing on your data.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits detection engineers and SOC analysts who already run Splunk Enterprise Security and want starting-point correlation searches mapped to MITRE ATT&CK. It is not a fit for teams without Splunk ES, for non-security users, or for anyone who plans to deploy the generic examples to production without reviewing and tuning them.

Download the skill