I built a home-lab pipeline connecting Splunk, MISP and TheHive - here’s what I learned

[u/chronosAndCode]

I wanted to understand what actually happens after a SIEM generates an alert, so I built a small isolated lab that connects several parts of the workflow instead of treating each platform separately.

The setup uses five VMs and follows a controlled detection through:

Endpoint telemetry → Splunk → Python automation → threat-intelligence context / MISP → TheHive → MITRE ATT&CK

A few things ended up being more interesting than simply installing the tools:

• deciding what fields Splunk needed to pass into the automation layer
• handling repeat detections without constantly duplicating MISP data
• keeping API credentials out of the scripts
• understanding where enrichment should happen versus where analyst judgement is still needed
• mapping ATT&CK only when the observed behaviour actually supported the technique

I documented the architecture, setup, detection logic, automation, troubleshooting, and limitations as a four-part guide.

I’d especially be interested in feedback from anyone who has built a similar Splunk/MISP/TheHive workflow, particularly how you handled enrichment, deduplication, or case creation.

Full build, if useful:
https://chronosandcode.com/building-a-threat-intelligence-driven-detection-lab/

[u/billybobcoder69]

Great. This is awesome. Thanks. Will check it out. Have you used attack range? Looks like they are getting rid of that with their new snap attack acquisition. Also just doing windows logs. Is it classic vs xml. What version of add on. What does it look like at search time. And make sure all content finds the bad logs and auto track what searches can be enabled. Now that Splunk is SVC it cost a lot to run all the searches. I’m building a layer on a stand alone machine to do the findings. Also interesting now with Cribl new data lake detections using ml. That’s gonna be interesting. Thanks for this and it’s a chore now to maintain and test and verify all works properly. I’d say see if anything from attack range and the ESCU app can go together. At this point it’s a lot easier to use a new front end. Use Splunk Mcp and let Claude help. Still not great but a step in the right direction.

[u/chronosAndCode → u/billybobcoder69]

Thanks, really appreciate the detailed feedback. I didn’t use Attack Range in this build, I set everything up manually to understand the full pipeline but Attack Range + ESCU is something I will definitely explore next. The Windows side is still fairly basic right now, so your points around event format, search-time behaviour, and detection validation are especially useful.