denis541/ICT-Infrastructure-Monitoring-Splunk

Enterprise-grade ICT infrastructure monitoring and security operations platform with Splunk. Demonstrates threat detection, Kenya Data Protection Act 2019 compliance, and 80% false positive reduction through alert tuning. # ICT Infrastructure Monitoring with Splunk **Analyst:** Denis O. Onduso | GitHub | Denis.Onduso@outlook.com **License:** MIT --- ## Overview End-to-end brute force detection pipeline built in a controlled home lab: attack simulation on Windows 11 via Kali Linux, log forwarding into Splunk Enterprise, and iterative detection rule tuning from 22 daily alerts down to 3–4 high-fidelity alerts. The project covers the full detection engineering lifecycle — threat modelling, rule development, false positive analysis, and tuning — against a realistic attack pattern documented under MITRE ATT&CK T1110. --- ## Architecture ```mermaid graph LR A[Kali Linux] -->|Brute Force - Hydra| B[Windows 11] B -->|Security Event Logs - Universal Forwarder| C[Splunk Enterprise] C -->|Alert| D[Analyst] ``` | Component | Details | |-----------|---------| | SIEM | Splunk Enterprise (Free Tier) | | Target | Windows 11 — Security Event Log source | | Attack simulation | Kali Linux — Hydra, custom PowerShell/Python scripts | | Network | Isolated VMware virtual subnet — no external traffic | | Hypervisor | VMware Workstation | --- ## Threat Model **Targeted technique:** T1110.001 — Brute Force: Password Guessing **Targeted asset:** Windows local authentication (NTLM) **Attack path:** Credential compromise → valid account access (T1078) → lateral movement or persistence **Detection approach:** Threshold-based analysis of Event ID 4625 (Failed Logon), filtered to network-based logon types, with a threat score assigned per source IP for analyst triage prioritisation. --- ## Detection Rule **File:** `/detection_rules/splunk/windows_auth_bruteforce.spl` ```spl index=windows sourcetype="WinEventLog:Security" EventCode=4625 (Logon_Type=3 OR Logon_Type=10) | stats count values(Logon_Type) as logon_types by src_ip, user | where count > 7 | eval threat_score = count * 10 | sort -threat_score | table src_ip, user, count, logon_types, threat_score ``` | Logic Component | Purpose | |----- …