Splunk Enterprise SIEM Home Lab

This project demonstrates the deployment of Splunk Enterprise 10.4.2 in a home lab to collect, index and investigate Linux security logs using Splunk Processing Language (SPL).

Project Overview

Security Information and Event Management (SIEM) platforms are a core technology used by Security Operations Centres (SOCs). In this project I built a Splunk Enterprise home lab to gain practical experience collecting, indexing and investigating Linux security logs.

Why I Built This Lab

I created this lab to gain practical SIEM experience beyond certification study. The project demonstrates log collection, event searching and security investigations using real Linux system logs.

Lab Environment

Implementation Summary

After installing Splunk Enterprise, I configured the administrator account and added the /var/log directory using continuous monitoring. Splunk successfully indexed more than 33,000 Linux events for investigation and analysis.

Key SPL Searches

index=main
index=main | stats count
index=main | top source
index=main | top user
index=main | top host
index=main | top sourcetype
index=main failed
index=main accepted
index=main sudo

Project Screenshots

Index main
Figure 1 — Viewing indexed events.
Top Source
Figure 2 — Top log sources.
Stats Count
Figure 3 — Total indexed event count.
Top Sourcetype
Figure 4 — Top source types.
Failed Search
Figure 5 — Failed authentication investigation.
Sudo Activity
Figure 6 — Administrative sudo activity.

Conclusion

Building this lab strengthened my understanding of SIEM deployment, Linux log analysis, authentication monitoring and security investigations using Splunk Enterprise.

← Back to Portfolio