01 ·
Splunk ES · top Gartner SIEM
Notable events, risk-based alerting, MITRE ATT&CK mapping. Native data ingestion from any source via Universal Forwarder. Risk-based alerting for noise reduction up to 90%.
MDR on Splunk Enterprise Security: leading SIEM, custom SPL rules.
The Fortgale European SOC 24·7·365 on the Splunk ES console. SPL detection rules tuned on European TTPs, ~11 min median containment, response orchestrated via Splunk SOAR.
Fortgale × Splunk
MDR · live
Splunk sensor activeEndpoint · cloud · identity telemetry
Splunk European SOC 24·7·365L2/L3 analysts · direct interaction
Fortgale Multi-domain AI tier-zeroNoise reduced by 94%
Fortgale Native Splunk responseMedian host isolation ~8 s
Live Proprietary intelligence34,000+ IoCs per week · European actors
Fortgale MDR live — Splunk + Fortgale SOC active
Compliance
ISO/IEC 27001
NIS2 ready
DORA aligned
GDPR · ENISA
Technology partnership
Splunk Enterprise Security
MITRE ATT&CK aligned
OpenCTI
Why Fortgale + Splunk
The Gartner-leading SIEM, operated with proprietary CTI.
Splunk Enterprise Security is the Gartner Leader SIEM/SOAR for the 11th consecutive year. Fortgale operates it with European analysts who develop custom SPL detection rules on European actor TTPs.
02 ·
European SOC 24·7·365
L2/L3 analysts develop custom SPL rules and ES content packs tuned on European TTPs. Triage <15 min on notable events. Threat hunting on Splunk Search using proprietary CTI.
03 ·
Splunk SOAR + IR
Custom playbook orchestration via Splunk SOAR: cross-tool response, automatic enrichment, ticketing. Direct escalation to Fortgale IR. Full NIS2 national CSIRT notification support.
How it works · architecture
Four blocks, one MDR cycle on Splunk.
From data ingestion to SOAR response — all governed by Fortgale with European analysts and proprietary CTI on European markets.
01 ·
01 · Ingestion
Data sources active
Splunk Cloud or on-prem with all data sources connected: endpoint, firewall, AD, M365, AWS/Azure, custom apps. Universal Forwarder + HEC + APIs.
02 ·
02 · Tier-zero
Custom SPL detection
ES content packs + custom SPL rules tuned by Fortgale on European actor TTPs. Risk-based alerting reduces noise by 90%, only real notables reach analysts.
03 ·
03 · Analysts
Our L2/L3 on the console
European SOC specialised on Splunk. Triage on notable events, hunting via Splunk Search, attribution to actor. Direct interaction in your business language.
04 ·
04 · Response
SOAR playbook + IR
Containment via Splunk SOAR custom playbooks: EDR isolation, AD lockout, firewall block, ticketing. Direct escalation to Fortgale IR for critical incidents.
Proof · service metrics
Four numbers that hold MDR on Splunk up.
Metrics measured on real customer telemetry — Q1 2026, updated quarterly.
~11 min
Median containment
from confirmed notable
from confirmed notable
90 %
Noise reduced
by risk-based alerting
by risk-based alerting
Custom
SPL rules MITRE-mapped
on European TTPs
on European TTPs
14 days
Full onboarding
Splunk ES + SOAR
Splunk ES + SOAR
Threat intelligence · attacks detected on Splunk
Infostealers and phishing kits contained via Splunk + ES correlation.
Selection of credential-theft threats detected on Fortgale customers with Splunk Enterprise Security. Splunk RBA (Risk-Based Alerting) aggregates multiple indicators into single notable events to reduce fatigue.
Infostealer
RedLine
Vector Distributed via malvertising, fake cracked software, drive-by · credential harvest from 100+ applications · plaintext HTTP / Telegram bot exfiltration
Detection · Splunk Splunk ES correlation rules on rare DNS queries + Fortgale IOC feed via Threat Intel Management · RBA risk score >80 trigger.
Infostealer
Lumma Stealer
Vector Distributed via fake CAPTCHA verification · process hollowing into legitimate browser · C2 exfiltration to dynamic DNS Cloudflare-proxied
Detection · Splunk Splunk ML Toolkit anomaly detection on outbound traffic patterns + custom SPL searches updated monthly by Fortgale.
Phishing kit · AiTM
EvilProxy
Vector Reverse-proxy phishing intercepts MFA session · session cookie hijack post-authentication · persistent access via OAuth refresh token
Detection · Splunk Splunk correlation between <em>impossible travel</em> + new device fingerprint + sign-in log audit · Fortgale runbook for token revocation.
Threat Actor
PhishSurf Nebula
Vector Phishing campaign brand-impersonating European financial institutions · landing pages hosted on bulletproof providers · credential harvest + token exchange
Detection · Splunk Splunk SOAR auto-blocking via firewall + Microsoft 365 + Okta logs correlation · weekly Fortgale IOC feed.
What the service includes
MDR on Splunk, in detail.
Every component designed to leverage Splunk ES with European SOC governance and proprietary CTI.
01
Managed Splunk ES
Splunk Cloud or on-prem licensing (or existing instance). Indexers, search heads, data sources, ES content packs managed by Fortgale. Continuous tuning.
02
Custom SPL detection
Custom SPL rules MITRE ATT&CK-mapped, tuned on European actor TTPs. Risk-based alerting. New rules deployed monthly based on the threat landscape.
03
Proprietary CTI in Splunk
34,000+ IoCs per week from Fortgale OpenCTI auto-imported into Splunk Threat Intelligence Framework. Lookup tables for SPL detection.
04
Splunk SOAR + IR
Custom SOAR playbooks: cross-tool containment, automatic enrichment, ticketing. Direct escalation to Fortgale IR team for critical incidents.
05
Reporting & governance
Executive reports with MTTD, MTTR, alert volume, risk score trend. Custom Splunk Glass Tables. NIS2/ISO 27001/GDPR audit documentation.
06
Threat hunting on Splunk
Monthly hunting on Splunk Search using proprietary CTI + Sigma rules. Focus on silent lateral movement, persistence, data staging not covered by automatic detections.
For whom · two angles
Same MDR on Splunk, two angles.
The CISO decides on risk. The IT lead decides on the runbook. Fortgale MDR produces evidence for both.
For the CISO
A named runbook per actor, on the Splunk stack.
Each month the CISO receives the profile of the 3 most likely actors against their sector, with the Fortgale MDR runbook already mapped to the Splunk Enterprise Security telemetry.
- Monthly threat briefingActors, observed TTPs, campaigns in progress on your sector.
- Splunk runbookLive MITRE-mapped playbooks, executable on the Splunk Enterprise Security console.
- Board-ready reportingRisk · impact · decision. No slideware technology.
For the IT lead
Zero translator handover. European analysts on your Splunk console.
When the Splunk alert is real, decision time is containment time. Our L2/L3 analysts know the Splunk Enterprise Security console and have a mandate to decide.
- Median containment ~11 minFrom confirmed alert to remediation in production.
- Native Splunk responseProcess kill, host isolation, network containment via Splunk Enterprise Security API.
- End-to-end integrationSplunk telemetry ingested into our multi-domain data fabric.
FAQ · frequently asked
Everything to know before talking to our analysts.
What is the MDR service on Splunk Enterprise Security?
Combines Splunk Enterprise Security (Gartner Leader SIEM) with the Fortgale European SOC 24·7·365. L2/L3 analysts develop custom MITRE-mapped SPL detection rules, monitor ES notable events, orchestrate response via Splunk SOAR and apply proprietary runbooks.
Do I need to already have Splunk?
No. Fortgale handles the full cycle: Splunk Cloud or on-prem licensing, indexer/search head deployment, data sources integration, ES content packs, tuning. Available both on existing instance or as part of the service.
Does the service include Splunk SOAR?
On request, yes. Splunk SOAR (formerly Phantom) is available as add-on module for playbook orchestration, cross-tool integration and response automation. The Fortgale SOC develops custom playbooks mapped to runbooks.
Is the service NIS2-compliant?
Yes. We support NIS2 transposition requirements: continuous monitoring, IoC collection for national CSIRT notification within 24 hours, technical documentation for 72-hour notifications. Splunk's configurable retention supports NIS2 log retention requirements.
Is Splunk only for logs or does it have XDR/EDR capabilities?
Splunk Enterprise Security is SIEM. For XDR/EDR it combines with Splunk Attack Analyzer and add-ons/integrations with third-party EDR (CrowdStrike, SentinelOne, Defender). Fortgale orchestrates the entire stack.
Talk to the outpost
One meeting. One NDA. One real runbook on Splunk.
We bring you the Report on your sector with the most likely actors and a concrete MDR runbook on your Splunk Enterprise Security console.