Splunk ES Development
Module 1
Getting Started with ES
Module 2
Security Monitoring and Incident Investigation
Module 3
Investigations
Module 4
Forensic Investigation with ES
Module 5
Risk and Network Analysis
Module 6
Web Intelligence
Module 7
User Intelligence
Module 8
Threat Intelligence
Module 9
Protocol Intelligence
Module 10
Glass Tables

Splunk ES Development

$1500 USD
Categories:
Reviews:
Splunk Enterprise Security Development

About this course

With its growing popularity and demand, Splunk professionals are one of the highest paying in the world. Splunk training is best suited for users that work with and administer big data. Analytics managers, Machine learning professionals, Systems Administrators, and beginners looking to get into the field of analytics can benefit from Splunk training. Learning Splunk does not require a technical background making it an appealing option for users with diverse educational backgrounds that are looking to get into the field of big data.

 

Number of jobs in the U.S. – 16,000+ (Source: LinkedIn)

 

U.S. National Average salary – $125,571/year (Source: ZipRecruiter)

 

This is an advanced level course and for someone who has a good understanding of Splunk Development. Students that don’t have any knowledge of Splunk Development should first take the Splunk Developer Course. This course covers all topics of Splunk Enterprise Security training

 

Prerequisite – Splunk Developer

Syllabus

This is an advanced level course and for someone who has a good understanding of Splunk Development. Students that don’t have any knowledge of Splunk Development should first take the Splunk Developer Course.

Module 1
Getting Started with ES

• Provide an overview of Splunk for Enterprise Security (ES) • Identify the differences between traditional security threats and new adaptive threats • Describe correlation searches, data models and notable events • Describe user roles in ES • Log on to ES

Module 2
Security Monitoring and Incident Investigation

• Use the Security Posture dashboard to monitor enterprise security status • Use the Incident Review dashboard to investigate notable events • Take ownership of an incident and move it through the investigation workflow • Use adaptive response actions during incident investigation • Create notable events • Suppress notable events

Module 3
Investigations

• Use ES investigation timelines to manage, visualize and coordinate incident investigations • Use timelines and journals to document breach analysis and mitigation efforts

Module 4
Forensic Investigation with ES

• Investigate access domain events • Investigate endpoint domain events • Investigate network domain events • Investigate identity domain events

Module 5
Risk and Network Analysis

• Understand and use Risk Analysis • Use the Risk Analysis dashboard • Manage risk scores for objects or users

Module 6
Web Intelligence

• Use HTTP Category Analysis, HTTP User Agent Analysis, New Domain Analysis, and Traffic Size Analysis to spot new threats • Filter and highlight events

Module 7
User Intelligence

• Evaluate the level of insider threat with the user activity and access anomaly dashboards • Understand asset and identity concepts • Use the Asset Investigator to analyze events • Use the Identity Investigator to analyze events • Use the session center for identity resolution (UBA integration)

Module 8
Threat Intelligence

• Use the Threat Activity dashboard to analyze traffic to or from known malicious sites • Inspect the status of your threat intelligence content with the threat artifact dashboard

Module 9
Protocol Intelligence

• Describe Stream events data is input into Splunk events • Use ES predictive analytics to make forecasts and view trends

Module 10
Glass Tables

• Build glass tables to display security status information • Add glass table drilldown options • Create new key indicators for metrics on glass tables