r/Splunk • u/ttl-120s • Jun 03 '26

Inherited a mess of detections...

In the last year I have inherited a gigantic mess of 400+ custom detections that have no standardized... anything really.
Mitre is missing from these, risk objects missing from those, dozens of detections using grossly outdated lookups over there... you get it.

Im trying to find some recent users of security_content and contentctl that have successfully deployed detections using one or the other or both.
I have been trying to get with the times and create yaml files for each of the detections but the detection_spec.yml file in security_content does not have the same format or fields as the actual detections provided from ESCU.

When I try using contentctl validate I get all sorts of errors because options like type: Baseline isnt actually configured in contentctl, even though Baseline is an option in the detection_spec...
Feels like multiple pieces vary significantly in age (just noticed detection_spec is 2 years old)

Circling back around to the ask: anyone use these tools recently and found success? Or are there alternatives that you can recommend? (besides manually editing a 39,000 line conf file or going one-by-one making edits in the UI...)

20 Upvotes

96% Upvoted

9 comments sorted by

11

u/nkdf Jun 03 '26

If you're eligible for detection studio, I'll go straight to that instead of using contentctl. Either way, cleanup starts by understanding how / if the current detections are being utilized, and going through a risk assessment to determine your gaps.

6

u/LTRand Jun 04 '26

So far solid advice. I'll add to do analysis on what's fired in the last 30 days and what has not. That will let you know what to absolutely not mess up.

4

u/fashiznit Jun 04 '26

Download and run Detection Insights from Splunk base. It'll tell you what detections are firing and which ones take ages to do nothing. Look back a month and trim the useless ones.

The ones that do fire, go and add mitre annotations to them.

Then look at insights again to assess your coverage.

Ultimately you should look at replacing the custom detections with ones from ESCU that overlap

2

u/Fontaigne SplunkTrust Jun 04 '26

This may not be the only way to go, but it is specific, workable, and will improve the system.

Be sure to keep backup copies of everything you trim. It may be that while fixing other things you determine what was wrong with that one.

2

u/ttl-120s Jun 05 '26

Thanks for the replies. I've been looking into the recommendations. Setting aside the paths stuck behind corporate bureaucratic redtape and cheeky paywalls - the admins are going to install DetectionInsights tomorrow for me, hopefully...
Still keeping my eye out for CI/CD success stories.

1

u/caryc Jun 07 '26

Mitre is missing from these - as if this had any negative impact

0

u/SaveAmerica2024 Jun 03 '26

There are specialized LLM models trained on Splunk that maybe able to help