Prerequisites
To be successful, students should have a working understanding of the topics covered in the following Splunk courses:
• Intro to Splunk
• Using Fields
• Visualizations
• Search Under the Hood
• Intro to Knowledge Objects
• Introduction to Dashboards
What you’ll learn in this course
This course is for SOC Analysts. This 13.5-hour instructor-led course prepares SOC Analysts to use Splunk Enterprise Security (ES)
Students identify and track incidents, analyze security risks, use predictive analytics, and discover threats.
Course Outline
Module 1 – Introduction
• The CyberSecurity Defense Analyst
• CIM, Data Models and Correlation Refresh
• Lab 1: Introducing the environment
Module 2 – Splunk Enterprise Security (ES) for Analysts
• What is SIEM again?
• Asset & Identity Framework
• Threat Intelligence Framework
• Notable Event Framework
• Adaptive Response Framework
• Incident Investigation Management in Splunk ES
• Lab 2: Pick up an investigation
Module 3 – Risk Analysis Framework
• Overview
• Lab 3: Continue your investigation with RBA
Module 4 – Working with Splunk SOAR
• Introducing Splunk SOAR
• Lab 4: Splunk SOAR Practice
Module 5 – Threat Hunting with PEAK
• PEAK Framework overview
• Lab 5: Hypothesis-based Threat Hunting Practice
Module 6 – Challenge Lab
• Lab 6: Run your own investigation
Further information
If you would like to know more about this course please contact us
