How should we tune Splunk correlation searches to reduce alert fatigue while successfully catching early indicators of lateral movement?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
How should we tune Splunk correlation searches to reduce alert fatigue while successfully catching early indicators of lateral movement?
2 real searches · 1 real-search pass
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
site:docs.splunk.com Enterprise Security risk-based alerting correlation searches notable event suppression throttling CIM data models Google ↗
site:help.splunk.com Splunk correlation search best practices scheduling throttling suppression risk modifiers Google ↗
- Configure correlation searches in Splunk Enterprise Security | Splunk Enterprise, Splunk Cloud Platform (last updated 2025-07-14T18:09:44.394Z) · help.splunk.com
- How risk modifiers impact risk scores in Splunk Enterprise Security | Splunk Enterprise, Splunk Cloud Platform (last updated 2025-07-14T18:05:39.845Z) · help.splunk.com
- Create a correlation search | Splunk Enterprise, Splunk Cloud Platform (last updated 2025-07-14T18:07:48.663Z) · help.splunk.com
- Throttle alerts | Splunk Enterprise (last updated 2025-07-04T01:34:54.367Z) · help.splunk.com
- Suppressing false positives using alert throttling | Splunk Enterprise, Splunk Cloud Platform (last updated 2025-07-14T18:08:49.792Z) · help.splunk.com
- Write better searches | Splunk Enterprise, Splunk Cloud Platform (last updated 2026-09-13T17:12:30.328Z) · help.splunk.com
- Part 4: Schedule the correlation search | Splunk Enterprise, Splunk Cloud Platform (last updated 2025-07-14T18:03:43.681Z) · help.splunk.com
- T1021 – Remote Services · attack.mitre.org
- T1078 – Valid Accounts · attack.mitre.org
- T1550.002 – Pass the Hash · attack.mitre.org
- T1569.002 – Service Execution · attack.mitre.org
- T1087 – Account Discovery · attack.mitre.org
- T1098 – Account Manipulation · attack.mitre.org
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
site:docs.splunk.com Enterprise Security risk-based alerting correlation searches notable event suppression throttling CIM data models OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
site:help.splunk.com Splunk correlation search best practices scheduling throttling suppression risk modifiers OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |