SOC field reference
The Splunk fields I actually query during an investigation — organized by where they show
up (email, endpoint, network, DNS, web, auth, file), why each one is worth pulling, what a
suspicious value looks like, and which IOC type it feeds. Click any field for the full note
and a ready-to-adapt SPL snippet.
Click any field for why it matters, what a suspicious value looks like, its IOC type, and a sample SPL query.
Not IOCs — the fields Splunk attaches to every event regardless of source. Always there, always worth checking first.
index=security host="WIN-JREYES" sourcetype="WinEventLog:Security" | table _time, host, source, sourcetype
The verbs you chain together before you ever get to a specific field — pipe one into the next.
index=network sourcetype=stream:tcp | stats count by src_ip, dest_ip | where count > 50 | sort -count
Which activity triggers which Event ID — the vocabulary underneath the Endpoint and Authentication fields above.
index=security sourcetype=WinEventLog:Security EventCode=4688 | table _time, host, Account_Name, New_Process_Name, Command_Line
Where the case usually starts — the message itself and what it carried.
index=email sourcetype=email | table _time, sender, recipient, subject, file_name
What actually ran once the attachment or link was opened — Sysmon / EDR telemetry.
index=endpoint sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 | table _time, host, User, Image, ParentImage, CommandLine
Where the host talked to once the payload was live — firewall, NetFlow, and stream data.
index=network sourcetype=stream:tcp | stats sum(bytes_out) as total_out by src_ip, dest_ip | sort -total_out
Resolution requests often surface a callback domain before the connection itself ever shows up.
index=network sourcetype=stream:dns | stats count by query | sort -count
The actual HTTP requests once a link was clicked or a payload called home.
index=web sourcetype=access_combined | stats count by url, http_user_agent | sort -count
Did the phishing lure actually lead to a credential being used somewhere.
index=security sourcetype=WinEventLog:Security EventCode=4625 | stats count by user, src | where count > 5
Not logons — attribute changes on the account itself. This is where quiet, long-term persistence hides.
index=security sourcetype=WinEventLog:Security EventCode=4738 | table _time, SamAccountName, PrimaryGroupId, AllowedToDelegateTo, NewUacValue
The verdict fields — what your AV/EDR actually said about the file in question.
index=endpoint sourcetype=antivirus signature=* | stats count by signature, file_name, vendor_product
No fields match that filter.