Incident handling with Splunk

Walkthrough summary

Incident handling with Splunk TryHackMe walkthrough with 20 answered prompts and lab methodology notes.

Sample prompts covered

• One suricata alert highlighted the CVE value associated with the attack attempt. What is the CVE value?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the CMS our web server is using?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the web scanner, the attacker used to perform the scanning attempts?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the IP address of the server imreallynotbatman.com?
  Open the walkthrough page to inspect the full answer and command flow.
• What was the URI which got multiple brute force attempts?
  Open the walkthrough page to inspect the full answer and command flow.