Claude Desktop (with MCP) 
    ↓
MCP Server (Python)
    ↓
Splunk Docker Container
    ↓
Security Events Sample Security Data

python --version

Step 1: Launch Splunk (Docker)
   ↓
Step 2: Generate sample security data (Python script)
   ↓
Step 3: Import data into Splunk (Web UI or HEC)
   ↓
Step 4: Verify data in Splunk (Search queries)
   ↓
Step 5: Setup Python environment (MCP server)
   ↓
Step 6: Configure Claude Desktop (MCP config)
   ↓
Step 7: Work as a SOC Engineer

# Create directory
mkdir C:\splunk-mcp-soc-demo
cd C:\splunk-mcp-soc-demo

git clone https://github.com/asecurityguru/ai-driven-soc-demo-repo.git
cd ai-driven-soc-demo-repo

copy generate_sample_data.py,requirements.txt,splunk_mcp_server.py ..\ #Copying files from git repo to splunk-mcp-soc-demo directory

cd .. # Moving out of git repo

# Download all the files from the demo into this directory
# (Use the files provided or download them)

# Run Splunk Enterprise
docker run -d \
  --platform linux/amd64 \
  -p 8000:8000 -p 8088:8088 -p 8089:8089 \
  -e "SPLUNK_START_ARGS=--accept-license" \
  -e 'SPLUNK_PASSWORD=Netguru123!' \
  -e "SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com" \
  -e "SPLUNK_HEC_TOKEN=abcd1234-abcd-1234-abcd-1234abcd1234" \
  --name splunk \
  splunk/splunk:latest

# Wait for Splunk to start (takes 2-3 minutes)
Write-Host "Waiting for Splunk to start..." -ForegroundColor Yellow
Start-Sleep -Seconds 180

# Check status
docker logs -f splunk


Administer Splunk Enterprise Docker containers

To see a list of example commands and environment variables for running Splunk Enterprise in a container, run:

docker run -it splunk/splunk help

To see a list of your running containers, run:

docker ps

To stop your Splunk Enterprise container, run:

docker container stop <container_id>

To restart a stopped container, run:

docker container start <container_id>

To access a running Splunk Enterprise container to perform administrative tasks, such as modifying configuration files, run:

docker exec -it <container_id> bash

# Generate sample security events (49 events)
python generate_sample_data.py

✅ Generated 49 security events
📁 Saved to: sample_security_events.json

Event breakdown:
  - Brute Force Attacks: 12 events
  - Data Exfiltration: 1 event
  - Malware C2 Traffic: 5 events
  - Port Scanning: 9 events
  - Privilege Escalation: 1 event
  - Phishing: 1 event
  - Normal Traffic: 20 events

URL: http://localhost:8000

Login credentials:
  Username: admin
  Password: Netguru123!

index=netguru | stats count

index=netguru | head 10

# Create virtual environment
python3 -m venv netguru

# Activate virtual environment
source netguru/bin/activate

# Deactivate virtual environment
deactivate

# Install dependencies
pip3 install --upgrade pip
pip3 install -r requirements.txt
pip3 install "mcp<2" splunk-sdk requests


****** Modified Requirements ******

mcp<2.0.0
#mcp>=0.9.0
splunk-sdk>=2.0.0
requests>=2.31.0
python-dotenv>=1.0.0

# Test the MCP server (press Ctrl+C to stop)
python3 splunk_mcp_server.py

#### Option 1: Check for Microsoft Store version
Test-Path "$env:LOCALAPPDATA\Packages\Claude_pzs8sxrjxfjjc"

#### If returns TRUE = You have Microsoft Store version
#### If returns FALSE = You have Direct Download version

#### Search for Claude executable
Get-ChildItem -Path "$env:LOCALAPPDATA" -Recurse -Filter "Claude.exe" -ErrorAction SilentlyContinue | Select-Object FullName

#### If path contains "Packages\Claude_pzs8sxrjxfjjc" = Microsoft Store version
#### If path contains "Programs\Claude" = Direct Download version

#### Check config location
ls ~/Library/Application\ Support/Claude/claude_desktop_config.json

#### If exists = Standard installation
#### If not exists = Check alternate locations

# Step 3: Add this configuration in the Notepad file (replace path with your actual path):

**If file is EMPTY or NEW:**

```json
{
  "mcpServers": {
    "splunk-soc": {
      "command": "C:\\splunk-mcp-soc-demo\\venv\\Scripts\\python.exe",
      "args": [
        "C:\\splunk-mcp-soc-demo\\splunk_mcp_server.py"
      ],
      "env": {
        "SPLUNK_HOST": "localhost",
        "SPLUNK_PORT": "8089",
        "SPLUNK_USERNAME": "admin",
        "SPLUNK_PASSWORD": "Admin123!"
      }
    }
  }
}

{
  "preferences": {
    "coworkScheduledTasksEnabled": false,
    "sidebarMode": "chat"
  },
  "mcpServers": {
    "splunk-soc": {
      "command": "C:\\splunk-mcp-soc-demo\\venv\\Scripts\\python.exe",
      "args": [
        "C:\\splunk-mcp-soc-demo\\splunk_mcp_server.py"
      ],
      "env": {
        "SPLUNK_HOST": "localhost",
        "SPLUNK_PORT": "8089",
        "SPLUNK_USERNAME": "admin",
        "SPLUNK_PASSWORD": "Admin123!"
      }
    }
  }
}

# Kill all Claude processes
Get-Process | Where-Object {$_.Name -like "*Claude*"} | Stop-Process -Force

# Wait a moment
Start-Sleep -Seconds 3

# Restart Claude Desktop from Start Menu

%APPDATA%\Claude\claude_desktop_config.json

# Open with notepad
notepad "$env:APPDATA\Claude\claude_desktop_config.json"

# Or navigate to folder
explorer "$env:APPDATA\Claude"

{
  "mcpServers": {
    "splunk-soc": {
      "command": "C:\\splunk-mcp-soc-demo\\venv\\Scripts\\python.exe",
      "args": [
        "C:\\splunk-mcp-soc-demo\\splunk_mcp_server.py"
      ],
      "env": {
        "SPLUNK_HOST": "localhost",
        "SPLUNK_PORT": "8089",
        "SPLUNK_USERNAME": "admin",
        "SPLUNK_PASSWORD": "Netguru123!"
      }
    }
  }
}

explorer "$env:APPDATA\Claude\logs"

~/Library/Application Support/Claude/claude_desktop_config.json

vi ~/Library/Application\ Support/Claude/claude_desktop_config.json

}

  "mcpServers": {
    "splunk-soc": {
      "command": " /Users/v.henry/Desktop/CCC/splunk-mcp-soc-demo/netguru/bin/python3",
      "args": [
        "/Users/v.henry/Desktop/CCC/splunk-mcp-soc-demo/splunk_mcp_server.py"
      ],
      "env": {
        "SPLUNK_HOST": "localhost",
        "SPLUNK_PORT": "8089",
        "SPLUNK_USERNAME": "admin",
        "SPLUNK_PASSWORD": "Netguru123!"
      }
    }
  }
}


********* File ***********

{
  "mcpServers": {
    "splunk-soc": {
      "command": "/Users/v.henry/Desktop/CCC/splunk-mcp-soc-demo/netguru/bin/python",
      "args": [
        "/Users/v.henry/Desktop/CCC/splunk-mcp-soc-demo/splunk_mcp_server.py"
      ],
      "env": {
        "SPLUNK_HOST": "localhost",
        "SPLUNK_PORT": "8089",
        "SPLUNK_USERNAME": "admin",
        "SPLUNK_PASSWORD": "Netguru123!"
      }
    }
  },
  "coworkUserFilesPath": "/Users/v.henry/Claude",
  "preferences": {
    "launchPreviewPersistedWorkspaces": [],
    "launchPreviewSessionScopedSessions": [],
    "coworkScheduledTasksEnabled": true,
    "coworkHipaaRestricted": false,
    "ccdScheduledTasksEnabled": true,
    "bypassPermissionsGateByAccount": {
      "fa433d58-284c-46a3-b603-89b5b94fc5dc": false


***********************************

~/.config/Claude/claude_desktop_config.json

nano ~/.config/Claude/claude_desktop_config.json

Get all high severity security alerts from the last 24 hours and prioritize them for me.

Investigate IP address 142.250.185.46 - what activity have we seen and is it malicious?

Analyze all activity for user "tdavis" in the last 24 hours. Is there any suspicious behavior?

Are there any brute force attacks happening? Show me accounts with multiple failed login attempts.

Detect any unusual data transfers that might indicate data exfiltration.

Give me a security operations summary for the last 24 hours with key metrics.