Course Overview
This 13.5-hour instructor-led course enables SOC Engineers to use Splunk’s Enterprise Security SIEM for detection engineering, incident response, automation, asset and identity configuration, and threat intelligence management. Other topics include ES event processing and normalization, managing risk, data models, deployment requirements, technology add-ons, and dashboard dependencies.
This course may be delivered over two or three days, with 13.5 total hours of content.
Who should attend
This course is for ES Administrators and Engineers.
Certifications
This course is part of the following Certifications:
Prerequisites
To further support understanding of course concepts, the following additional courses or knowledge may be beneficial:
- Intro to Splunk
- Using Fields (SUF)
- Visualizations
- Search Under the Hood
- Intro to Knowledge Objects
- Creating Knowledge Objects (CKO)
- Creating Field Extractions (CFE)
- Enriching Data with Lookups (EDL)
- Data Models (SDM)
- Introduction to Dashboards (ITD)
- Splunk Enterprise System Administration (SESA)
- Splunk Enterprise Data Administration (SEDA)
Follow On Courses
- Advanced SOAR Implementation (ASOARI)
- Administering Splunk Enterprise Security (ASES)
- Splunk Enterprise Data Administration (SEDA)
- Splunk Enterprise System Administration (SESA)
- Developing SOAR Playbooks (DSOARP)
- Administering Splunk SOAR (ASOAR)
- Investigating Incidents with Splunk SOAR (IISS)
- Using Splunk Enterprise Security (USES)