splunk/security_content resource

Health v2 · maintenance only

Adoption not part of the score

1676 stars · 489 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A repository of Splunk security detections, Analytic Stories, and SOAR playbooks maintained by the Splunk Threat Research Team, mapped to MITRE ATT&CK, the Cyber Kill Chain, and CIS Controls. It provides pre-built searches, machine-learning algorithms, and response playbooks for detecting, investigating, and responding to threats in Splunk environments.

Use cases

• find pre-built Splunk detections for MITRE ATT&CK techniques
• build a SOC detection library without writing searches from scratch
• map my detection coverage across the MITRE ATT&CK framework
• get automated response playbooks for common threats
• research TTPs and detection strategies for emerging threats
• integrate threat research content into Splunk Enterprise Security
• test detections against simulated attack data

When to choose

• you run Splunk (Enterprise Security, Essentials, or core) and want curated, maintained detections
• you need MITRE ATT&CK-mapped detection coverage with analytic stories and playbooks
• you want vendor-maintained security content updated with the latest threat research

When to avoid

• you use a SIEM other than Splunk and cannot translate SPL queries
• you need a detection engine or runtime rather than content (rules/queries)
• you want a general-purpose threat intelligence feed rather than detection content

Facets

dataset · maturity active

security monitoring alerting ci-cd security developer-tools self-hosted cross-platform detection-engineering mitre-attack siem splunk analytic-stories soc threat-hunting soar-playbooks automation

Member repositories

For agents

markdown · JSON · MCP: product_card(name="splunk/security_content")