Detect OS Exhaustion Flood in Splunk

// Detect OS Exhaustion Flood via syslog kernel messages and network device alerts
// Branch 1: Linux kernel SYN flood and connection tracking exhaustion
(
    (index=linux_logs OR index=syslog OR index=os) sourcetype=syslog facility=kern
    | eval message=lower(_raw)
    | eval SYNFloodKernel=if(match(message, "(possible syn flooding|tcp: request_sock_tcp|sending cookies|tcp: drop open request|possible syn attack|syn attack)"), 1, 0)
    | eval ConnTrackFull=if(match(message, "(nf_conntrack.*table full|ip_conntrack.*table full|connection tracking.*full)"), 1, 0)
    | eval OrphanedSockets=if(match(message, "(tcp.*orphaned|orphaned sockets.*exceeded)"), 1, 0)
    | eval SuspicionScore=SYNFloodKernel + ConnTrackFull + OrphanedSockets
    | where SuspicionScore > 0
    | eval AttackType=case(
        SYNFloodKernel=1, "SYN Flood - Linux Kernel Alert",
        ConnTrackFull=1, "Connection Tracking Table Full",
        OrphanedSockets=1, "TCP Orphaned Socket Exhaustion",
        true(), "OS TCP Exhaustion"
      )
    | eval DataSource="linux-kernel"
    | table _time, host, AttackType, DataSource, _raw, SYNFloodKernel, ConnTrackFull, OrphanedSockets, SuspicionScore
)
| append [
    // Branch 2: Network device flood detection (Cisco ASA, Palo Alto, Juniper, CheckPoint, Fortinet)
    (index=network OR index=firewall OR index=ids OR index=ips)
        (sourcetype=cisco:asa OR sourcetype="pan:threat" OR sourcetype="pan:traffic"
         OR sourcetype=juniper:junos OR sourcetype=checkpoint:syslog
         OR sourcetype=fortigate_traffic OR sourcetype=syslog)
    | eval message=lower(_raw)
    | eval SYNFloodNW=if(match(message, "(syn flood|syn attack|synflood|syn-flood|half-open.*exceed)"), 1, 0)
    | eval ACKFloodNW=if(match(message, "(ack flood|ack attack|ackflood|ack-flood)"), 1, 0)
    | eval TCPExhaustionNW=if(match(message, "(tcp.*exhaust|tcp.*state.*exhaust|connection.*table.*full|tcp.*flood|dos.*tcp|ddos.*tcp|tcp.*half.open)"), 1, 0)
    | eval SuspicionScore=SYNFloodNW + ACKFloodNW + TCPExhaustionNW
    | where SuspicionScore > 0
    | eval AttackType=case(
        SYNFloodNW=1 AND ACKFloodNW=0, "SYN Flood - Network Device Alert",
        ACKFloodNW=1 AND SYNFloodNW=0, "ACK Flood - Network Device Alert",
        SYNFloodNW=1 AND ACKFloodNW=1, "Combined SYN/ACK Flood",
        TCPExhaustionNW=1, "TCP State Exhaustion - Network Device Alert",
        true(), "OS Exhaustion Flood"
      )
    | eval DataSource="network-device"
    | table _time, host, AttackType, DataSource, _raw, SYNFloodNW, ACKFloodNW, TCPExhaustionNW, SuspicionScore
]
| stats count as AlertCount, values(AttackType) as AttackTypes, max(SuspicionScore) as MaxScore,
    earliest(_time) as FirstSeen, latest(_time) as LastSeen
  by host, DataSource
| where AlertCount >= 3
| eval DurationSeconds=LastSeen - FirstSeen
| table FirstSeen, LastSeen, DurationSeconds, host, AttackTypes, AlertCount, MaxScore, DataSource
| sort - AlertCount