MISP
My description on how to connect Splunk to your MISP instance can be found here.
Fight against Phase 1 Fight against Phase 2 Fight against Phase 3 Fight against Phase 4 IOC sharing Find random generatet URL's APT Simulator to test your capabilities CyCON 2019 Secure your Microsoft software Password's Cyber Threat Intelligence OSINT Information gathering Malware analysis Equation MISP Forensic Splunk
Attack macro's SIEM
Incident response vuln, IPS and malware found weblogs weblogs summary useragents weblogs excl 80 but incl 443 proxy unusual events blocked postfix IDS win event summary win user creation and failed logons MISP animated attack map Find suspicious phishing domains Windows UseCases
Demo alerting with Kali2 Splunk - Pastebin gatherings raspberry Honeypot for Splunk