The Fidelity Detection Lab is a blue team cybersecurity portfolio project that demonstrates practical detection engineering and incident investigation using Splunk Enterprise.
The project simulates a security incident involving suspicious account creation, user activity, and excessive document downloads. Using Splunk Search Processing Language (SPL), custom detections, dashboards, and investigation reports were developed to analyze attacker behavior and document findings.
- Build custom Splunk detections
- Develop a Splunk investigation dashboard
- Investigate suspicious user activity
- Analyze security events using SPL
- Document investigation findings
- Package detection content using contentctl
- Splunk Enterprise
- Splunk Search Processing Language (SPL)
- contentctl
- Git
- GitHub
- Visual Studio Code
- Windows
- Detection Engineering
- Security Monitoring
- Log Analysis
- Threat Hunting
- Incident Investigation
- Dashboard Development
- Security Documentation
- Git Version Control
Fidelity_Detection_Lab/
│
├── dashboards/
├── detections/
├── docs/
│ └── screenshots/
├── investigations/
├── reporting/
├── stories/
├── data_sources/
├── lookups/
├── macros/
├── README.md
└── contentctl.yml
A custom Splunk Enterprise dashboard was developed to support the investigation of a simulated August 2024 Fidelity Investments security incident.
The dashboard provides visibility into:
- Top Active Users by Event Count
- Users with Excessive Document Downloads
- Top Source IP Addresses
- Newly Created Accounts
- Incident Activity Timeline
Five investigation reports were created during the simulated incident.
| Investigation | Description |
|---|---|
| Investigation 01 | Excessive Document Downloads |
| Investigation 02 | Top Source IP Addresses |
| Investigation 03 | Suspicious User Activity |
| Investigation 04 | Events by Type |
| Investigation 05 | Newly Created Accounts |
Each investigation includes:
- Objective
- SPL Query
- Findings
- Analyst Assessment
- Screenshot Evidence
Custom Splunk searches were created to identify suspicious activity within the simulated Fidelity environment.
Examples include:
- Excessive document downloads
- Suspicious account creation
- High-volume source IP activity
The project was successfully validated and packaged using contentctl.
Validation screenshots are included in the repository.
Evidence collected during the investigation includes:
- Document download analysis
- Source IP analysis
- Suspicious user activity
- Event type analysis
- Newly created account investigation
Screenshots are available in:
docs/screenshots/investigations/
The attacker behavior observed during this simulated investigation was mapped to the MITRE ATT&CK framework based on evidence collected from Splunk Enterprise.
| Technique | Description | Evidence in Project |
|---|---|---|
| T1078 – Valid Accounts | Attackers used valid accounts to access the environment. | Newly created accounts successfully authenticated and initiated suspicious activity. |
| T1087 – Account Discovery | Attackers searched for customer account information after gaining access. | Suspicious user activity analysis identified customer search activity. |
| T1005 – Data from Local System | Customer documents were accessed prior to download. | Document download investigation showed customer files being viewed and downloaded. |
| T1020 – Automated Exfiltration | Potential removal of sensitive customer data from the environment. | Multiple document download events were identified during the investigation, indicating possible data exfiltration. |
Through this project I gained hands-on experience with:
- Splunk Search Processing Language (SPL)
- Detection Engineering
- Dashboard Development
- Security Monitoring
- Incident Investigation
- Threat Hunting
- GitHub Documentation
This project uses simulated log data inspired by publicly reported information about the 2024 Fidelity Investments security incident.
-
Yahoo Finance. Fidelity data breach exposes details of thousands of customers.
https://www.finance.yahoo.com/news/fidelity-data-breach-exposes-details-130300914.html -
SC Media. Fidelity Investments confirms August breach affected 77K customers.
https://www.scworld.com/news/fidelity-investments-confirms-august-breach-affected-77k-customers
This project uses simulated log data inspired by publicly reported information about the 2024 Fidelity Investments data breach. It was created solely for educational and portfolio purposes and does not contain proprietary Fidelity Investments systems, logs, or customer data.