Apologies if this has already been covered. I was looking at the ECA Splunk app and noticed an AI Assistant for SPL button. From what I have read, junior programming jobs have quickly been replaced by Codex/Claude. Are we already to the point where LLMs are replacing basic Splunk skills? When you can do a prompt, "Show me potential IoCs for the past 7 days ignoring 10.0.4.2", does having SPL knowledge even matter? I have 2 Splunk certs and plan on getting the Splunk Certified Cyber Defense Analyst one. Should I concentrate on getting more LLM skills instead? Thank you.

@Paul Daigle II Thank you, looking forward to your thoughts! To expand, I was just about to edit my post to include: Should I concentrate on getting more LLM skills, or Splunk Architecture/Engineering instead?

Applied. Very exciting! I asked on LinkedIn, and would just like to confirm: I work 6-3 some days and 2-11 other days. Would we be able to complete the tasks before or after those times? Or will tasks have to be done like 9-5? Also, if accepted, is there anything that should be worked on before June 1 that would help with the program?

@Paul Daigle II Thank you for the feedback. The Severity column was one of the more difficult issues I had doing this. How do you define severity? OTX doesn't have a good way to define it. A couple options I thought of: A. By hit count. More hits = more severe? I tweaked the hit count lower so any hits should have shown as medium or high. However, you can have a hit count of 1 and that 1 might be a ping to a C2 server that only connects every 3 months. Hard to show that quickly on a dashboard. B. Weighted by hit and pulse count. Again, how would this be weighted? C. Remove it. D. Use VirusTotal. I thought about using VirusTotal to check the IPs and Malicious Files, but would add another requirement to set up. For the "OTX Threat Intel - TTPs Active in Your Environment" panel, there was a Severity column and I just removed it for the above reasons. Looking back, I should have just removed the Severity column all together, especially the "OTX Malicious File Hits - Your Environment". Because if, say, mimikatz.exe shows up once, it would show up as a 1, thus a Low. We know of course know that mimikatz.exe is not a Low priority. Thanks again for the feedback!

@Kenneth Ellington Maybe I'm reading too much into this, but are we then doing the Classic Dashboard XML or Dashboard Studio JSON?

Looking forward to it.