Agent skills and subagents for Splunk — threat hunting, TA development, and dashboard building. Works with Cursor and other AI coding agents that support the Agent Skills specification.
npx splunk-skillsThis installs all skills and agents globally to ~/.cursor/. For project-level installation:
npx splunk-skills --projectnpx skills add dtherrick/splunk-skillsThis uses the Vercel skills CLI and installs only the skills (not agents) from the skills/ directory.
Skills are instruction sets that guide your AI coding agent through specialized workflows. They are installed to ~/.cursor/skills/ (global) or .cursor/skills/ (project).
| Skill | Description |
|---|---|
| peak-threat-hunting | Conduct threat hunts in Splunk using the PEAK framework (Prepare, Execute, Act with Knowledge). Supports hypothesis-driven, baseline, and model-assisted hunts with MITRE ATT&CK mapping. |
| splunk-ta-development | Build Splunk Technology Add-ons (TAs) end-to-end — analyze log samples, create props.conf/transforms.conf, load data, and validate field extractions via the Splunk MCP server. |
| splunk-dashboard-studio | Build Dashboard Studio dashboards using JSON definitions. Covers all visualization types, layout design, tokens, interactivity, Dynamic Options Syntax (DOS), and conditional formatting. |
Agents are subagent definitions that handle specialized tasks autonomously. They are installed to ~/.cursor/agents/.
| Agent | Description |
|---|---|
| dashboard-studio-builder | Builds Dashboard Studio dashboards as JSON definitions. Full lifecycle: discovers data via Splunk MCP, assembles the definition, deploys, and validates. |
| splunk-dashboard-builder | Builds Simple XML dashboards from SPL queries and analysis context. Specializes in security operations, threat hunting, and operational monitoring dashboards. |
Most skills and agents require a Splunk MCP server connection to run queries and deploy dashboards against a Splunk instance.
MIT