Splunk SIEM Security Training

Syllabus of Splunk SIEM Security Course

• Provide an overview of Splunk for Enterprise Security (ES)
• Identify the differences between traditional security threats and new adaptive threats
• Describe correlation searches, data models and notable events
• Describe user roles in ES
• Log on to ES

• Use the Security Posture dashboard to monitor enterprise security status
• Use the Incident Review dashboard to investigate notable events
• Take ownership of an incident and move it through the investigation workflow
• Use adaptive response actions during incident investigation
• Create notable events
• Suppress notable events

• Use ES investigation timelines to manage, visualize and coordinate incident investigations
• Use timelines and journals to document breach analysis and mitigation efforts

• Investigate access domain events
• Investigate endpoint domain events
• Investigate network domain events
• Investigate identity domain events

• Understand and use Risk Analysis
• Use the Risk Analysis dashboard
• Manage risk scores for objects or users

• Use HTTP Category Analysis, HTTP User Agent Analysis, New Domain Analysis, and Traffic Size Analysis to spot new threats
• Filter and highlight events

• Evaluate the level of insider threat with the user activity and access anomaly dashboards
• Understand asset and identity concepts
• Use the Asset Investigator to analyze events
• Use the Identity Investigator to analyze events
• Use the session center for identity resolution (UBA integration)

• Use the Threat Activity dashboard to analyze traffic to or from known malicious sites
• Inspect the status of your threat intelligence content with the threat artifact dashboard

• Describe Stream events data is input into Splunk events
• Use ES predictive analytics to make forecasts and view trends

• Build glass tables to display security status information
• Add glass table drilldown options
• Create new key indicators for metrics on glass tables