Author detections using the Detection Builder agent in Splunk Enterprise Security
You can create, tune, validate, and troubleshoot event-based detections and finding-based detections in Splunk Enterprise Security using the integrated AI Assistant available in the detection editors. Access this Detection Builder agentic chat in the detection editor to optimize the effectiveness of detections and reduce the time required to create the SPL query so that you can identify and respond to threats faster.
The AI-assisted Detection Builder chat can provide the following building blocks or suggestions to author a detection:
- Title: An intuitive and consistent title for the detection that typically populates the
savedsearch_namefield and helps to filter detections, populate dashboards for clearer executive overview, prioritize threats, and trigger specific investigation playbooks. - Description: A clear description for the detection that explains how the detection works, what specific logic it uses, the malicious behavior it targets, the boundaries of the alerts, potential triage instructions, without reverse-engineering complex SPL queries during an active incident.
- Annotations: Suggestions from common cybersecurity frameworks such as MITRE ATT&CK, which provides additional context and makes it easier to perform root cause analysis.
- Background micro-processes to check specific asset lists, analyze a specific user agent, or validate network activity.
- Context-aware SPL authoring to build the search query for the detection.
The AI-assisted Detection Builder chat cannot do the following tasks:
- validate if the detection is ready to save state
- save a detection
- clone a detection
- change a detection version
- change a detection status such as On, Off, Test
- create new detection version
- identify differences between detections
- test a detection
Access the Detection Builder agent in the detection editor to build detections
Follow these steps to access the Detection Builder agent and build detections:
- In Splunk Enterprise Security, go to Security content.
- Select Content management and then select Create new content to access the detection editor.
- Select the AI Assistant icon (
) to open the agentic chat.
Note: You must upgrade to Splunk version 10.1.x or higher to access the AI agent to build detections. Only Splunk Cloud deployments support the agentic chat in Splunk Enterprise Security Essentials and Premier Editions. Additionally, you must turn on the agentic chat. For more information, see Turn the Ai Assistant on or off in Splunk Enterprise Security. - Select the suggested chip on the Detection Builder agent such as Build detection or Explain detection. Alternatively, you can type own prompt to use the agentic chat. You can use the guidance provided by the chat to create and tune detections by scrolling to specific sections within the detection and updating fields in the detection. You can also ask the agent to explain the logic of the detection.
- Select Approve or Reject to approve or dismiss the suggestions provided by the agentic chat.
Note: You won't lose the content suggestions if you open or close the chat panel. However, the chat content is lost when you close the detection editor.