Splunk: Setting up a SOC Lab

Walkthrough summary

Splunk: Setting up a SOC Lab TryHackMe walkthrough with 14 answered prompts and lab methodology notes.

Sample prompts covered

• What is the default port for Splunk?
  Open the walkthrough page to inspect the full answer and command flow.
• In Splunk, what is the command to search for the term coffely in the logs?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the default port, on which Splunk Forwarder runs on?
  Open the walkthrough page to inspect the full answer and command flow.
• Follow the same steps and ingest /var/log/auth.log file into Splunk index Linux_logs. What is the value in the sourcetype field?
  Open the walkthrough page to inspect the full answer and command flow.
• Create a new user named analyst using the command adduser analyst. Once created, look at the events generated in Splunk related to the user creation activity. How many events are returned as a result of user creation?
  Open the walkthrough page to inspect the full answer and command flow.