S

Detection Studio

Developer tool

by Splunk

The authoring environment for Splunk Enterprise Security's detections: a detection engineer plans, develops, tests, deploys and then monitors a detection in one place, instead of moving it between a notebook, a ticket and production.

Find alternatives to Detection Studio

What it does

• Threat detection and response
• Data security

Features 5

• Integrated detection lifecycleA detection engineering workspace inside Enterprise Security to develop, version-control and manage detections.
• Unified detection libraryThousands of out-of-the-box detections from the Splunk Threat Research Team plus customer-owned detections.
• Detection health analysisSurfaces opportunities to improve detection coverage and keeps detection health maintained over time.
• Data source gap identificationIdentifies gaps in the data collection required for priority detections.
• MITRE ATT&CK coverage mappingAutomatically maps the active detection library to MITRE ATT&CK to visualize coverage and blind spots.

Sources

Pricing

Not found · 19 Sep 2026

Read 2026-09-19: the page states no rate, plan or allowance. Splunk's own pricing page sells workload and ingest packages for the platform and names no line item for this product.

Description

Official documentation · 19 Sep 2026

Splunk's own page description, read 2026-09-19: "As a feature of Splunk Enterprise Security, Detection Studio provides the complete detection lifecycle experience that enables detection engineers to seamlessly plan, develop, test, deploy, and monitor detections."

What it does

Official documentation · 19 Sep 2026

Authoring and operating the detections that find attacks is threat-detection-response; the subject matter throughout is data-security.

Sold within

Not found · 19 Sep 2026

Splunk's own page states the relationship in its first clause: "As a feature of Splunk Enterprise Security, Detection Studio provides the complete detection lifecycle experience". That is the vendor's own entitlement sentence, so the access term is included-with-parent and the parent is the existing splunk-enterprise-security record.

Name

Official documentation · 19 Sep 2026

Page <h1> "Detection Studio" and <title> "Detection Studio | Splunk"; Splunk's A-Z product index lists it as "Detection Studio".

URL

Official documentation · 19 Sep 2026

The product's own page in Splunk's A-Z product index, read on 2026-09-19.

Deployment

Official documentation · 19 Sep 2026

Delivered through Splunk's hosted platform; the page names no self-hosted edition of its own.

Also from Splunk

• Splunk AI Assistant Platform

  Assistant inside Splunk Cloud Platform that turns plain-English questions into SPL, the query language Splunk searches machine data with, and explains existing searches back to an analyst.

• Splunk AI Toolkit Developer tool

  Platform for building, deploying and running agentic AI systems on Splunk data.

• Splunk Enterprise Security Application

  Integrated threat detection, investigation and response platform with agentic AI, SOAR, UEBA and SIEM unified into one SecOps experience.

• Splunk IT Service Intelligence Application

  AIOps and service-intelligence solution that uses AI-driven field discovery and AI-generated event correlation, summaries and root-cause guidance to connect IT events to business service health.

• Splunk Observability Cloud Application

  Observability platform where AI agents correlate signals across domains, propose remediation actions such as rollbacks or capacity changes, and provide dedicated agent/AI-system observability alongside infrastructure monitoring.

• AI SRE Application

  Splunk's site-reliability agent: an AI teammate for IT and SRE teams that troubleshoots an incident, finds the root cause and proposes the fix, working from the telemetry already in Splunk rather than from a human's search.

• Splunk Agent Launchpad Agent platform

  No-code builder and launcher for AI agents inside Splunk: security, IT and network teams create an agent and start it from the workflow where the signal appeared, rather than from a separate console.

• Splunk Agent Observability Platform

  Observability for somebody else's AI stack: Splunk traces a customer's own agents, the models they call, the vector databases behind them and the infrastructure underneath, and reports where the stack is failing.

• Agent Visibility Application

  The tracing half of Splunk's agent observability: one agent followed end to end from its own reasoning steps down to the GPU the run executed on, so a failure can be attributed to a layer rather than guessed at.

• Agent and Model Evaluation Application

  Production scoring for agent traffic: every interaction graded for correctness, safety and tool use rather than a sample of them, with the evaluations built for agents instead of adapted from model benchmarks.

• Runtime AI Guardrails Application

  Splunk's enforcement layer for agents: a guardrail built from a customer's own evaluations blocks an unsafe agent action before the tool call executes, and logs every allow-or-block decision for audit.

Open Splunk in the directory

Something wrong here? Send a correction — quote this product id: splunk-detection-studio.