Data Source: Splunk Forwarded Events | Detection.FYI

Splunk External Alerts

Sep 19, 2026 · Data Source: Splunk Use Case: Threat Detection Resources: Investigation Guide Promotion: External Alerts Rule Type: Custom Query (KQL) Rule Type: Higher-Order Data Source: Splunk Forwarded Events Domain: Network ·
Share on:

Generates a detection alert for each Splunk alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Splunk alerts in the app.

Read More