From Question to Search
What is it?
An investigation is a chain of questions, each answered by a search whose result decides the next question. You start from the alert, ask the narrowest question that would confirm or refute it, and let the answer point you forward — you do not start from a query.
Why it matters
Analysts who start from a query wander; analysts who start from a question converge. Framing the next question is the skill — the SPL is just how you answer it. This is what transfers to any SIEM.
Where you see it
Alert: 'impossible travel for j.rai'. Q1 where did the logins come from? → stats values(src) by user. Q2 did either succeed? → filter result=success. Q3 what did the successful session do next? → pivot to the host/proxy logs.
What normal looks like
A clean investigation is a short list of questions with a definite answer each, ending in a conclusion you could defend. Every search exists because a question required it.
What suspicious looks like
In your own process: a pile of searches with no question behind them, or a conclusion reached before the questions were answered. Both mean you are pattern-matching, not investigating.
How analysts investigate
Write the alert as a question. Ask the narrowest sub-question that would move you toward confirm or refute. Answer it with one search. Read the answer, then write the next question. Stop when you can state a defensible conclusion.
Common beginner mistakes
- Building an elaborate query before knowing what question it answers.
- Deciding the verdict first, then searching only for events that confirm it.
The alert is a question, not a query
ALERT: impossible travel — j.rai
Q1 which sources? ─ stats values(src) by user → Riyadh + Kyiv
Q2 did either succeed? ─ ... result=success → Kyiv succeeded 02:14
Q3 what did that session do? ─ pivot to host/proxy → data staged, egress
each answer chooses the next question — the SPL only answers itQuick check
You are handed an alert. What is the right FIRST move in Splunk?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.