Splunk Enterprise Security (ES): The Complete Training Course in Prince William County

What You Will Learn - 

1. Introduction to Splunk ES

• Overview of Splunk ES features and architecture

• Understanding the role of ES in a modern SOC

• Key components: dashboards, correlation searches, and incidents

2. Security Monitoring and Incident Investigation

• Navigating ES's Security Posture and Incident Review dashboards

• Investigating security incidents using notable events

• Leveraging investigation workflows for root cause analysis

3. Analyst Tools and Data Sources

• Understanding data models and source types used in ES

• Utilizing security domains, event types, and CIM compliance

• Applying key analyst tools like Risk Analysis, Threat Intelligence, and Search

4. Splunk ES Deployment and Installation

• Deployment architecture considerations

• ES installation process and licensing

• Performing initial configuration and hardening the environment

5. Validating and Onboarding Data

• Verifying data source compatibility with ES

• Ensuring CIM compliance and field normalization

• Troubleshooting and validating data flows in ES

6. Custom Add-ons and Data Enrichment

• Working with custom add-ons for non-standard data

• Field mapping and creating custom extractions

• Integrating context-enrichment data like GeoIP, Asset, and Identity

7. Tuning and Creating Correlation Searches

• Understanding how correlation searches work

• Tuning existing correlation rules for better accuracy and noise reduction

• Creating and scheduling custom correlation searches

8. Asset and Identity Management

• Defining assets and identities in Splunk ES

• Managing asset/identity lookups and data integration

• Using identity data to enhance event correlation

9. Threat Intelligence Framework

• Integrating threat intel feeds using TAXII/STIX

• Managing and applying threat indicators

• Leveraging threat intel in correlation searches and dashboards

SOC Analyst (Tier 1, 2, or 3)

SIEM Engineer / Splunk Engineer

Cybersecurity Analyst

Security Operations Center (SOC) Lead

Threat Intelligence Analyst

Incident Responder

IT Security Administrator

Compliance Analyst / Auditor