Mostly efficient executable Splunk/Python code, but the 'Key Concepts' and 'Tools & Systems' sections re-explain largely known concepts (what DNS tunneling/DGA/DoH are) and the Shannon-entropy Python is duplicated verbatim in references/ and scripts/, so it could be tightened; not level 3 because not every token earns its place, and not level 1 because the bulk is concrete code rather than padded prose.

Provides complete, copy-paste-ready Splunk SPL and Python (e.g. the subdomain-length, entropy, z-score, and exfil-volume queries) plus a concrete sample output format, matching the fully-executable anchor; not level 2 because the code is real and complete rather than pseudocode, despite a minor '--' comment quirk in Step 6.

Six clearly numbered detection steps provide a sequence, but there are no explicit validation/triage checkpoints (e.g. confirm a suspected tunneling domain via passive DNS before escalating), matching the steps-listed-but-checkpoints-implicit anchor; not level 3 because explicit verify/recovery steps are absent, and not level 1 because the sequence is present and ordered.

Bundle files exist (references/api-reference.md and scripts/agent.py) but the body never links to or signals them, and their content (entropy code, query templates) is duplicated inline, matching the references-present-but-not-signaled anchor; not level 3 because navigation to the bundles is missing, and not level 1 because sections are organized rather than a monolithic nested wall.

Lists multiple concrete detection actions — 'detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection' — matching the multiple-specific-actions anchor; it is not the level below because it goes well beyond naming a single domain and action.

Explicitly answers both what ('Analyzes DNS query logs to detect...') and when ('Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls'), matching the both-what-and-when anchor; not level 2 because the trigger is explicit, not merely implied.

Includes natural SOC terms a user would actually say — 'DNS tunneling', 'DGA', 'C2', 'SOC', 'SIEM', 'exfiltration' — giving good coverage rather than only jargon or a single keyword, so it clears the level-2 bar.

Occupies a clear niche (DNS-based exfiltration/threat detection for SOC teams) with distinct triggers unlikely to fire for unrelated skills; not level 2 because the scope is narrowly scoped to DNS threat abuse rather than generically overlapping.