That's super interesting, Matthias!

All those can be easily implemented in Splunk with simple SPL. On DE use cases, it's up to the detection engineer creativity and the data available.