Echoing @richgalloway alert fatigue is a real thing.   
 Also, there are plenty of security related events happening all the time anyway, why not write an app that detects some of those?  There's a lot of good stuff happening in the "risk based" surfacing of mundane events that you could look into also.  Several good talks about it from Splunk .conf 2018 (or 17 maybe?). 
 Alternatively, you could write an app to periodically test existing use cases, and now that I'm coming up with this idea it think it's great.  Here goes: 
 
 Install the Splunk Security Essentials app 
 Take a look at the uses cases 
 Pick some of the most relevant to today's environment 
 Write an app that would on a schedule generate log events to trigger the use cases 
 The premise being you want to test that your indexing, parsing, scheduling, and alerting layers are all working properly, as @richgalloway  said, this is especially important for very rare alerts and something I've practiced at various locations 
 
 Now that I think about it...there are entire companies built on this premise already, so much for the genius idea 😛 
 Maybe work on something in Splunk with the Machine Learning Toolkit...that's pretty hot these days. 
						
					
					... View more