Detect SNMP (MIB Dump) in Splunk

| multisearch
    [
    search index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\snmpwalk.exe" OR Image="*\\snmpget.exe" OR Image="*\\snmpbulkwalk.exe"
       OR Image="*\\snmptable.exe" OR Image="*\\snmpset.exe" OR Image="*\\snmpgetnext.exe"
       OR (CommandLine="*snmp*" AND (CommandLine="*.1.3.6*" OR CommandLine="*-c public*"
           OR CommandLine="*-c private*" OR CommandLine="*-c cisco*" OR CommandLine="*-v2c*")))
    | eval detection_type="snmp_tool_execution_windows"
    | eval using_default_community=if(match(lower(CommandLine), "-c public|-c private|-c cisco|-c monitor"), 1, 0)
    | eval mib_walk=if(match(CommandLine, "\\.1\\.3\\.6"), 1, 0)
    | eval risk_score=case(using_default_community=1 AND mib_walk=1, 95, using_default_community=1, 85, mib_walk=1, 75, 1=1, 70)
    | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, detection_type, using_default_community, mib_walk, risk_score
    ]
    [
    search index=linux (sourcetype="linux_secure" OR sourcetype="syslog")
      (process="snmpwalk" OR process="snmpget" OR process="snmpbulkwalk"
       OR process="snmpbulkget" OR process="snmptable" OR process="snmpset"
       OR message="*snmpwalk*" OR message="*snmpget*" OR message="*snmpbulk*")
    | eval detection_type="snmp_tool_execution_linux"
    | eval using_default_community=if(match(lower(coalesce(message, "")), "-c public|-c private|-c cisco"), 1, 0)
    | eval mib_walk=if(match(coalesce(message, ""), "\\.1\\.3\\.6"), 1, 0)
    | eval risk_score=if(using_default_community=1, 85, 70)
    | table _time, host, user, process, message, detection_type, using_default_community, mib_walk, risk_score
    ]
    [
    search index=network (sourcetype="syslog" OR sourcetype="cisco:ios" OR sourcetype="cisco:asa"
      OR sourcetype="juniper:junos" OR sourcetype="paloalto:firewall")
      ("SNMP" OR "snmp")
      ("Authentication failure" OR "authenticationFailure" OR "Unknown community"
       OR "wrong community" OR "No Such Name" OR "invalid community" OR "community string")
    | stats count as failure_count, values(_raw) as sample_events by host, span(_time, 1h)
    | where failure_count >= 5
    | eval detection_type="snmp_auth_failures"
    | eval risk_score=case(failure_count > 50, 92, failure_count > 20, 78, 1=1, 62)
    | table _time, host, failure_count, sample_events, detection_type, risk_score
    ]
    [
    search index=network sourcetype="stream:udp" dest_port=161
    | stats count as snmp_requests, dc(dest_ip) as unique_targets, values(dest_ip) as target_ips
        by src_ip, src_host, span(_time, 10m)
    | where snmp_requests > 20 OR unique_targets > 3
    | eval detection_type="high_volume_snmp_scan"
    | eval risk_score=case(unique_targets > 20, 95, unique_targets > 10, 85, snmp_requests > 100, 80, 1=1, 65)
    | table _time, src_host, src_ip, snmp_requests, unique_targets, target_ips, detection_type, risk_score
    ]
| sort - _time