Name: Splunk Attack Range Review (2026): Detection Engineering Lab
Item: Splunk Attack Range
Rating: 4
Author: Todd Davis

Review date: July 2026 · Rating: 4.0 / 5 · Verdict: Best free option for Splunk shops wanting realistic detection engineering practice.

What Is Splunk Attack Range?

Splunk Attack Range is an open-source project (Apache 2.0) maintained by the Splunk Threat Research Team. It spins up a complete attack simulation environment in AWS or Azure using Terraform — Windows domain controllers, Linux servers, attack VMs, and Splunk Universal Forwarders pre-configured to ship telemetry into your Splunk instance.

The key differentiator: all attack telemetry feeds directly into your Splunk instance. You are not training in a generic lab — you are training in your Splunk, with your dashboards, using your detection rules against real adversary behavior.

I have deployed Splunk Attack Range for three Splunk-first teams. In every case, the moment an analyst sees their own detection rule fire against Atomic Red Team telemetry in their own Splunk instance, the lightbulb goes on. That is the value — not the lab itself, but the bridge between theory and their actual workflow.

What Splunk Attack Range Does Well

Native Splunk integration. Forwarders, indexes, and dashboards are pre-configured. No custom integration work needed if you already run Splunk.
Realistic attack telemetry. Pre-loaded with Atomic Red Team tests mapped to MITRE ATT&CK. The telemetry is genuine Windows event logs, Sysmon, and network traffic — not simulated data.
Fast deployment for Terraform users. If you know Terraform and AWS, the lab is live in 2–4 hours. If not, budget a day of learning.
Completely free (software). Apache 2.0 license. No usage limits, no seat caps, no vendor lock-in.
Extensible. Add your own attack VMs, custom Windows event log sources, or additional network segments. It is infrastructure-as-code, so customization is the point.

Where Splunk Attack Range Falls Short

Splunk-only. If you run Elastic, QRadar, or Sentinel, the integration value is zero. The telemetry is Splunk-formatted and forwarder-dependent.
Requires Terraform + cloud skills. Not a "download and run" tool. You need AWS/Azure basics, Terraform comfort, and Linux admin ability.
Ongoing AWS/Azure costs. $50–200/month depending on instance sizes and runtime hours. Factor this into your "free" calculation.
No built-in scoring or reporting. You track your own progress. No dashboards telling you which analysts improved — that is on you to build.
Scenario library is limited. Atomic Red Team is extensive but static. No quarterly threat updates like commercial platforms provide.
No team management. Single-user or shared-credential access. No role-based permissions, progress tracking, or certification paths.

✅ Best For

Splunk-centric SOC teams
Detection engineers building custom rules
Teams with Terraform/AWS skills
Budget-conscious organizations
Red team / blue team exercises

❌ Skip If

You do not use Splunk
No Terraform or cloud experience
Need team management / reporting
Want pre-built quarterly scenarios
Need training up in under a day

Deployment & Real Costs

Splunk Attack Range is "free" software but not free to run:

AWS/Azure hosting: $50–200/month depending on instance types and how often you run exercises
Setup time: 2–4 hours (Terraform-experienced) or 1–2 days (new to Terraform)
Maintenance: 2–4 hours/month — patching, scenario updates, infrastructure tweaks
Staff cost: If your engineer earns $90K/year and spends 5% of their time on the lab, that is $4,500/year in labor

Total first-year cost for a team without spare engineering time: $6,000–8,000 (hosting + labor). Still cheaper than commercial platforms, but not zero.

How Splunk Attack Range Compares

Feature	Splunk Attack Range	RangeForce	Security Onion
License cost	$0	$300–1,200/user/yr	$0
Hosting cost	$50–200/mo	$0	$50–150/mo
SIEM integration	✅ Splunk-native	✅ Multi-SIEM	✅ Elastic/HELK
Setup difficulty	Medium	Low	High
Team features	❌ None	✅ Built-in	❌ None
Scenario updates	Manual (Atomic)	Quarterly	Manual

Verdict

Splunk Attack Range is the right choice when your team lives in Splunk and you want detection engineering practice that maps directly to your production workflow. It requires technical skill to deploy and maintain, but the payoff — analysts who understand how their detection rules behave against real attack telemetry — is worth the investment. If you do not use Splunk or lack cloud engineering capacity, look elsewhere. For Splunk shops with an engineer who can spare a day of setup, it is the best free detection lab available.

Need Help Setting Up a Detection Engineering Lab?

I help teams match their existing SIEM and skill level to the right training infrastructure — whether that is Splunk Attack Range, a commercial platform, or something in between.

Work With Todd →

Splunk Attack Range Review (2026): The Best Free Detection Engineering Lab