Suricata SOC Investigation

Suricata SOC Investigation is a Splunk app for investigating Suricata IDS and IPS alerts through analyst-focused dashboards, correlation views, anomaly detection, and ATT&CK-aligned context. It helps SOC teams move beyond basic alert counts by providing workflows for triage, attack-story reconstruction, target risk scoring, MITRE mapping, and alert-driven investigation. The app is designed for security analysts who ingest Suricata data into Splunk and need a practical investigation experience built around detection review, prioritization, and response-oriented analysis.