Author detections using the Detection Builder agent in Splunk Enterprise Security

Use the Detection Builder agent to create, optimize, validate, and troubleshoot event-based detections in Splunk Enterprise Security. Access this Detection Builder agentic chat in the detection editor to reduce the time required to create the SPL query so that you can identify and respond to threats faster.​

Note: The Detection Builder agent is turned off in Splunk Enterprise Security version 8.8 for finding-based detections.

How to use the Detection builder agent

Following are some ways that you can use the Detection Builder agent:
  • Optimize detection SPL: Analyze the detection SPL to identify performance bottlenecks, eliminate anti-patterns, and leverage data model acceleration using the tstats command.
  • Validate detection: Verifies SPL syntax, required form fields, data model references, and schedules alignment to confirm that the detection is ready to save.
  • Troubleshoot detections: Identifies detections that don't run and checks their data availability, acceleration status, field cardinality, and recent finding history.
  • Configure risk: Suggests risk objects, dynamic tokenized risk messages such as $field$ and scores calibrated against environment-wide risk metrics.
  • Configure detection output: Recommends output classification such as findings versus intermediate findings, severity, title templates, recommended fields, and drilldown searches.
  • Guided search help: Explains guided search queries in addition to providing guidance and warnings when converting guided searches into SPL queries.
  • Configure finding-groups: Helps configure finding-based detection timing parameters such as lookback window, max append time, and overlap to reduce alert noise.
  • Create customizations: Analyzes detections that are activated across the environment to automatically draft custom Instructions for the agent.based on your SOC environment and suggests performance improvements to the detection search query.

The AI-assisted Detection Builder chat cannot do the following tasks:

  • save a detection
  • clone a detection
  • change a detection version
  • change a detection status such as On, Off, Test
  • create new detection version
  • identify differences between detections
  • test a detection

Prerequisites:

  • Splunk Platform version 10.1.x or higher and Splunk Enterprise Security version 8.6 or higher for Cloud
  • Splunk Platform version 10.4.x or higher and Splunk Enterprise Security version 8.8 and higher for Cloud Connected customer managed platforms (CMP).

  • Download the Splunk Cloud Connect app version 2.0 from Splunkbase.

Access the Detection Builder agent in the detection editor to build detections

Follow these steps to access the Detection Builder agent and build detections:

  1. In Splunk Enterprise Security, go to Security content.
  2. Select Content management and then select Create new content to access the detection editor.
  3. Select the AI Assistant icon () to open the agentic chat.
    Note: You must upgrade to Splunk version 10.1.x or higher to access the AI agent to build detections. Only Splunk Cloud deployments support the agentic chat in Splunk Enterprise Security Essentials and Premier Editions. Additionally, you must turn on the agentic chat. For more information, see Turn the Ai Assistant on or off in Splunk Enterprise Security.
  4. Select the suggested chip on the Detection Builder agent. The following actions are available for the Detection Builder agent:

    • Build detection: Build the detection SPL query

    • Explain this detection: Explain the logic of the detection

    • Suggest title: Suggests an intuitive and consistent title for the detection that typically populates the savedsearch_name field and helps to filter detections, populate dashboards for clearer executive overview, prioritize threats, and trigger specific investigation playbooks.

    • Suggest description: Suggest a clear description for the detection that explains how the detection works, what specific logic it uses, the malicious behavior it targets, the boundaries of the alerts, potential triage instructions, without reverse-engineering complex SPL queries during an active incident.

    • Suggest annotations: Suggests tactics and techniques from common cybersecurity frameworks such as MITRE ATTACK Framework, which provides additional context and matches the behavior being detected.

    • Troubleshoot detection: Provides tips to troubleshoot a detection

    • Suggest risk message: Suggests a message that describes the precise malicious behavior being flagged by the detection.

    Alternatively, you can type own prompt to use the agentic chat. You can use the guidance provided by the chat to create and tune detections by scrolling to specific sections within the detection and updating fields in the detection.

  5. In the Detection builder agent instructions, select whether you want the agent to use default instructions, or Splunk standards, or custom instructions to build the detection SPL query.
  6. Select Approve or Reject to approve or dismiss the suggestions provided by the agentic chat.
    Note: You won't lose the content suggestions if you open or close the chat panel. However, the chat content is lost when you close the detection editor.