Abishek's Blog

Incident Analysis: SSH Brute-Force Attack Detected by Wazuh

Dec 23, 20253 min read

Coordinated Login Attack Detection with a Custom Alert Action (Splunk)

Dec 22, 20253 min read

Detecting Web Reconnaissance with Wazuh — Catching the Attack Before It Starts

Most attacks don’t begin with exploitation.They begin with looking around. In this lab, I focused on detecting web reconnaissance activity — the phase where an attacker maps a target, tests endpoints, and looks for weaknesses. The idea was to see whe...

Dec 23, 20253 min read

Threat Intelligence Alerting in Splunk — Making the SIEM Speak First

Dec 21, 20252 min read

Threat Intelligence Correlation in Splunk — Practical Guide

Dec 20, 20253 min read

Spotting XSS Attempts in Web Logs — What the Logs Actually Tell You

Alright.This one will be more analytical + reflective, less step-by-step, more “how I thought while doing it”, so it doesn’t feel repetitive. Use-Case-05 — XSS Attack Detection using Splunk Spotting XSS Attempts in Web Logs — What the Logs Actually ...

Dec 19, 20253 min read

Turning SQL Injection Detection into a Real SOC Alert

From search to alert I already had a search that reliably detected SQL injection–style URL parameters like id=, query=, and search=. Instead of modifying it heavily, I kept the logic simple and focused on reliability. The same detection query was reu...

Dec 17, 20252 min read

Detecting SQL Injection Attempts Using Apache Logs in Splunk

I wanted to focus on application-level attacks, not just scanning behavior. SQL injection is one of the most common and dangerous web attacks. Even basic injection attempts leave traces in web server logs, especially in URL parameters. So the goal of...

Dec 16, 20253 min read

Building a Real-Time SOC Web Monitoring Dashboard in Splunk

Platform: Apache on Ubuntu → Splunk EnterpriseFocus: SOC-style real-time visibility After detecting suspicious web activity using searches, I wanted to move one step closer to real SOC monitoring.In a SOC, analysts don’t keep running searches all da...

Dec 15, 20253 min read

Web Server Threat Detection — Apache logs in Splunk

Platform: Apache on Ubuntu → Splunk EnterpriseGoal: Detect reconnaissance and probing activity on a web server by monitoring 404s and access to admin paths. summary I set up a Splunk Universal Forwarder on an Ubuntu VM to forward Apache access logs t...

Dec 14, 20254 min read

How I Investigate an EDR Alert Step-by-Step

When an EDR alert pops up, the first thing a SOC analyst does is pause and assess. The process is methodical and structured, not rushed. It starts with classification—figuring out what kind of alert it is. Is it a file, process, network connection, o...

Dec 3, 20252 min read

Command Palette

Latest articles