Unsupervised Machine Learning with Splunk: the cluster command

Alex Teixeira
Detect FYI
Published in
7 min readFeb 19, 2024

--

If you are in cyber for long, you should have probably heard this one:

There are known knowns. There are things we know we know. We also know there are known unknowns. That is to say, we know there are some things we do not know. But there are also unknown unknowns, the ones we don’t know we don’t know.

Secretary of Defense Donald Rumsfeld, 2002

To pick a use case from that, let's focus on web browsers for a moment.

--

--

I design and build threat detection and triage/hunting SIEM/EDR/XDR content for Enterprise #SecOps teams #DetectionEngineering http://opstune.com