◆ Detection rules

Splunk Security Content

Apache-2.0

Splunk's analytic stories and SPL detections, each tied to test data in Splunk Attack Data.

source ↗ ★ 1,687 last push 2026-09-10

Summary

This project gives you access to our repository of Analytic Stories, security guides that provide background on tactics, techniques and procedures (TTPs), mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls. They include Splunk searches, machine learning algorithms and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.

from the project README

Formats: splyaml
License: Apache-2.0
Added: 2026-09-10

Get it

From the project’s own instructions where it documents any; otherwise a plain clone.

shell

$ git clone https://github.com/splunk/security_content.git

shell
```
$ pip install contentctl-ng
```
contentctl-ng validates, builds and tests the content the way Splunk's threat research team does.

4,256 files 310.7 MB repository

.yml 3,743
.json 171
.py 129
.png 101
.csv 74
(no ext) 11
.md 10
.ipynb 5

Splunk Security Content

Summary

Get it

Contents

Related tools

Splunk Security Content