The technology addon "TA-latmov" was designed based off SANS' 2018 Hunt Evil Poster. This poster focuses on lateral movement from forensic evidence found on the source/destination endpoint after the action has occurred.

PoC to deploy to Windows UFs allowing both host and it's IP be index-time fields.

Actively monitor a series of Splunk's indexes for integrity control enablement and the results. https://docs.splunk.com/Documentation/Splunk/latest/Security/Dataintegritycontrol#Check_your_hashes_to_validate_your_data

A utility to disable and limit the amount of telemetry Splunk can collect on your instance.

What is on your network that you don't know about? Vulnerability scanners can help provide that visibility, but what happens if it's being blocked by a network or host-based firewall? Leverage the UF to perform L2 and L3 asset discovery.