Splunk Firewall Monitoring

Challenge & context

Making raw events useful for analyst review.

Solution approach

SPL queries, regex fields and port/destination dashboards provide triage signals, not independent proof of an attack.

What the available evidence supports

• Structured log field extraction
• Allowed and denied connection views