splunk/security_content

Splunk's Security Research team publishes SPL searches as YAML, run on a schedule by Enterprise Security. Query against a store, on an interval — the familiar model.

The organizing idea that is not familiar is the analytic story: detections are grouped into named narratives (a campaign, a malware family, a technique cluster) rather than standing alone, and adopting a story means adopting its searches together.

YAML with the SPL in a search field:

name: Cisco Secure Firewall - Binary File Type Download
type: Anomaly
status: production
data_source:
    - Cisco Secure Firewall Threat Defense File Event
search: |
    `cisco_secure_firewall` EventType=FileEvent FileDirection="Download"
    | stats count ... by FileDirection FileType src dest
    | `cisco_secure_firewall___binary_file_type_download_filter`
how_to_implement: |
    This search requires ... Replace the macro definition with
    configurations for your Splunk environment.
known_false_positives: IT admins or developers may legitimately download ...

Two conventions matter more than the SPL itself:

• Macros in backticks. A leading macro like `cisco_secure_firewall` stands in for your index/sourcetype configuration, and every search ends with a ..._filter macro that exists so you can suppress known false positives without editing the search. Neither is defined in the rule — you define them.
• type distinguishes TTP (behavior with a known technique), Anomaly (statistically unusual, expect tuning), Hunting (not meant to alert as-is) and Correlation. Treating a Hunting search as a production detection is the most common misuse.

how_to_implement becomes the implementation guide on a rule's page and known_false_positives becomes tuning notes. Both are load-bearing here — a Splunk search without its macros configured does not run at all.

data_source names the specific log source and add-on required.

• No search here works out of the box. The macros are placeholders by design. how_to_implement is not optional reading.
• type: Hunting searches are exploratory and will return volume. Check the content type before scheduling one as an alert.