What's New
This project gives you access to over 2,000 production-ready detections, built and maintained by the Splunk Threat Research Team. Each detection is mapped to MITRE ATT&CK, tested against real attack data, and grouped into Analytic Stories that connect related threats into a broader picture. Where an automated response exists, Splunk SOAR playbooks are included, giving your SOC everything needed to detect, investigate, and respond.Enable your SOC with Proven detections
Detection Categories
Detections by Platform
Detection Coverage MITRE ATT&CK
A snapshot in time of what technique we currently have some detection coverage for. The visualization below shows our current coverage across all MITRE ATT&CK tactics.
MITRE ATT&CK Coverage Overview
Detection counts per tactic with MITRE technique breakdown
We Value Your Feedback!
Help us improve! Please take a moment to share your thoughts on our website.
Questions?
Please use the GitHub issue tracker to submit bugs or request features.
If you have questions or need support, you can:
- Join the #security-research room in the Splunk Community Slack.
- Post a question to Splunk Answers
- If you are a Splunk Enterprise customer with a valid support entitlement contract and have a Splunk-related question, you can also open a support case on the https://www.splunk.com/ support portal
Contribute Content
If you want to help the rest of the security community by sharing your own detections, see our contributor guide for more information on how to get involved!