# Building a Risk-Based Secure Network Analytics Detection with Splunk Detection Editor (Alpha)

DevFeed: [Building a Risk-Based Secure Network Analytics Detection with Splunk Detection Editor (Alpha)](<https://devfeed.tech/articles/building-a-risk-based-secure-network-analytics-detection-with-splunk-detection-editor-alpha-8412.md>)

Original publisher: [Read original article](<https://blogs.cisco.com/security/bhusa-2026-soc-sna/>)

Author: Aditya Sankar

Published: 2026-09-07T15:00:32Z

Content type: article

Language: en

Sources: [Security @ Cisco Blogs](<https://devfeed.tech/sources/security-cisco-blogs.md>)

Topics: [Network](<https://devfeed.tech/topics/network.md>), [incident](<https://devfeed.tech/topics/incident.md>)

Tags: [black-hat](<https://devfeed.tech/tags/black-hat.md>), [building](<https://devfeed.tech/tags/building.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [data](<https://devfeed.tech/tags/data.md>), [dns](<https://devfeed.tech/tags/dns.md>), [documentation](<https://devfeed.tech/tags/documentation.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [network-operations-center](<https://devfeed.tech/tags/network-operations-center.md>), [noc](<https://devfeed.tech/tags/noc.md>), [security](<https://devfeed.tech/tags/security.md>), [security-operations-center](<https://devfeed.tech/tags/security-operations-center.md>), [soc](<https://devfeed.tech/tags/soc.md>), [splunk-cloud](<https://devfeed.tech/tags/splunk-cloud.md>), [splunk-enterprise-security](<https://devfeed.tech/tags/splunk-enterprise-security.md>)

## AI overview

This article explains how to use Splunk Detection Editor (Alpha) to develop a Cisco Secure Network Analytics detection and add its alarms as risk events in Splunk Enterprise Security. It covers SPL development and testing, sample data, risk scoring, CIM fields, and investigation drilldowns, with risk-based alerting used to correlate behavior over time.

## Source excerpt

At Black Hat USA, we used Splunk Detection Editor Alpha to turn Cisco SNA alarms into risk events with context, drilldowns & analyst-ready investigation paths.