Using Splunk Enterprise Security

Using Splunk Enterprise SecurityUSESSPSplunkSP-USES8<ul> <li>ES concepts, features, and capabilities</li><li>Security monitoring and Incident investigation</li><li>Use risk-based alerting and risk analysis</li><li>Assets and identities overview</li><li>Creating investigations and using the Investigation Workbench</li><li>Detecting known types of threats</li><li>Monitoring for new types of threats</li><li>Using analytical tools and dashboards</li><li>Analyze user behavior for insider threats</li><li>Use threat intelligence tools</li><li>Use protocol intelligence</li></ul>To be successful, students should have a solid understanding of the following courses: <ul> <li>Intro to Splunk</li><li><a class="fl-href-prod" href="/swisscom/fr/product/splunk-its"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Intro to Splunk (ITS)</a></li><li><a class="fl-href-prod" href="/swisscom/fr/course/splunk-suf"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Using Fields (SUF)</a></li><li><a class="fl-href-prod" href="/swisscom/fr/product/splunk-svz"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Visualizations (SVZ)</a></li><li><a class="fl-href-prod" href="/swisscom/fr/product/splunk-suh"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Search Under the Hood (SUH)</a></li><li><a class="fl-href-prod" href="/swisscom/fr/product/splunk-iko"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Intro to Knowledge Objects (IKO)</a></li><li><a class="fl-href-prod" href="/swisscom/fr/course/splunk-itd"><svg role="img" aria-hidden="true" focusable="false" data-nosnippet class="cms-linkmark"><use xlink:href="/css/img/icnset-linkmarks.svg#linkmark"></use></svg>Introduction to Dashboards (ITD)</a></li></ul>Module 1 - Getting Started with ES <ul> <li>Describe the features and capabilities of Splunk Enterprise Security (ES)</li><li>Explain how ES helps security practitioners prevent, detect, and respond to threats</li><li>Describe correlation searches, data models and notable events</li><li>Describe user roles in ES</li><li>Log into Splunk Web and access Splunk for Enterprise Security</li></ul>Module 2 - Security Monitoring and Incident Investigation <ul> <li>Use the Security Posture dashboard to monitor ES status</li><li>Use the Incident Review dashboard to investigate notable events</li><li>Take ownership of an incident and move it through the investigation workflow</li><li>Create notable events</li><li>Suppress notable events</li></ul>Module 3 – Risk-Based Alerting <ul> <li>Give an overview of Risk-Based Alerting</li><li>View Risk Notables and risk information on the Incident Review dashboard</li><li>Explain risk scores and how to change an object's risk score</li><li>Review the Risk Analysis dashboard</li><li>Describe annotations</li><li>Describe the process for retrieving LDAP data for an asset or identity lookup</li></ul>Module 4 – Assets & Identities <ul> <li>Give an overview of the ES Assets and Identities framework</li><li>Show examples where asset or identity data is missing from ES dashboards or notable events</li><li>View the Asset & Identity Management Interface</li><li>View the contents of an asset or identity lookup table</li></ul>Module 5 – Investigations <ul> <li>Use investigations to manage incident response activity</li><li>Use the investigation workbench to manage, visualize and coordinate incident investigations</li><li>Add various items to investigations (notes, action history, collaborators, events, assets, identities, files and URLs)</li><li>Use investigation timelines, lists and summaries to document and review breach analysis and mitigation efforts</li></ul>Module 6 – Security Domain Dashboards <ul> <li>Describe the ES security domains</li><li>Use the Security Domain dashboards to troubleshoot various security threats</li><li>Learn how to launch the Security Domain dashboards from Incidents Review and from a notable event Action menu</li></ul>Module 7 – User Intelligence <ul> <li>Understand and use user activity analysis</li><li>Use investigators to analyze events related to an asset or identity</li><li>Use access anomalies to detect suspicious access patterns</li></ul>Module 8 – Web Intelligence <ul> <li>Use the web intelligence dashboards to analyze your network environment</li><li>Filter and highlight events</li></ul>Module 9 – Threat Intelligence <ul> <li>Give an overview of the Threat Intelligence framework and how threat intel is configured in ES</li><li>Use the Threat Activity dashboard to see which threat sources are interacting with your environment</li><li>Use the Threat Artifacts dashboard to examine the status of threat intelligence information in your environment</li></ul>Module 10 – Protocol Intelligence <ul> <li>Explain how network data is input into Splunk events</li><li>Describe stream events</li><li>Give an overview of the Protocol Intelligence dashboards and how they can be used to analyze network data</li></ul>Module 1 - Getting Started with ES <ul> <li>Describe the features and capabilities of Splunk Enterprise Security (ES)</li><li>Explain how ES helps security practitioners prevent, detect, and respond to threats</li><li>Describe correlation searches, data models and notable events</li><li>Describe user roles in ES</li><li>Log into Splunk Web and access Splunk for Enterprise Security</li></ul>Module 2 - Security Monitoring and Incident Investigation <ul> <li>Use the Security Posture dashboard to monitor ES status</li><li>Use the Incident Review dashboard to investigate notable events</li><li>Take ownership of an incident and move it through the investigation workflow</li><li>Create notable events</li><li>Suppress notable events</li></ul>Module 3 – Risk-Based Alerting <ul> <li>Give an overview of Risk-Based Alerting</li><li>View Risk Notables and risk information on the Incident Review dashboard</li><li>Explain risk scores and how to change an object's risk score</li><li>Review the Risk Analysis dashboard</li><li>Describe annotations</li><li>Describe the process for retrieving LDAP data for an asset or identity lookup</li></ul>Module 4 – Assets & Identities <ul> <li>Give an overview of the ES Assets and Identities framework</li><li>Show examples where asset or identity data is missing from ES dashboards or notable events</li><li>View the Asset & Identity Management Interface</li><li>View the contents of an asset or identity lookup table</li></ul>Module 5 – Investigations <ul> <li>Use investigations to manage incident response activity</li><li>Use the investigation workbench to manage, visualize and coordinate incident investigations</li><li>Add various items to investigations (notes, action history, collaborators, events, assets, identities, files and URLs)</li><li>Use investigation timelines, lists and summaries to document and review breach analysis and mitigation efforts</li></ul>Module 6 – Security Domain Dashboards <ul> <li>Describe the ES security domains</li><li>Use the Security Domain dashboards to troubleshoot various security threats</li><li>Learn how to launch the Security Domain dashboards from Incidents Review and from a notable event Action menu</li></ul>Module 7 – User Intelligence <ul> <li>Understand and use user activity analysis</li><li>Use investigators to analyze events related to an asset or identity</li><li>Use access anomalies to detect suspicious access patterns</li></ul>Module 8 – Web Intelligence <ul> <li>Use the web intelligence dashboards to analyze your network environment</li><li>Filter and highlight events</li></ul>Module 9 – Threat Intelligence <ul> <li>Give an overview of the Threat Intelligence framework and how threat intel is configured in ES</li><li>Use the Threat Activity dashboard to see which threat sources are interacting with your environment</li><li>Use the Threat Artifacts dashboard to examine the status of threat intelligence information in your environment</li></ul>Module 10 – Protocol Intelligence <ul> <li>Explain how network data is input into Splunk events</li><li>Describe stream events</li><li>Give an overview of the Protocol Intelligence dashboards and how they can be used to analyze network data</li></ul>- ES concepts, features, and capabilities - Security monitoring and Incident investigation - Use risk-based alerting and risk analysis - Assets and identities overview - Creating investigations and using the Investigation Workbench - Detecting known types of threats - Monitoring for new types of threats - Using analytical tools and dashboards - Analyze user behavior for insider threats - Use threat intelligence tools - Use protocol intelligenceTo be successful, students should have a solid understanding of the following courses: - Intro to Splunk - Intro to Splunk (ITS) - Using Fields (SUF) - Visualizations (SVZ) - Search Under the Hood (SUH) - Intro to Knowledge Objects (IKO) - Introduction to Dashboards (ITD)Module 1 - Getting Started with ES - Describe the features and capabilities of Splunk Enterprise Security (ES) - Explain how ES helps security practitioners prevent, detect, and respond to threats - Describe correlation searches, data models and notable events - Describe user roles in ES - Log into Splunk Web and access Splunk for Enterprise Security Module 2 - Security Monitoring and Incident Investigation - Use the Security Posture dashboard to monitor ES status - Use the Incident Review dashboard to investigate notable events - Take ownership of an incident and move it through the investigation workflow - Create notable events - Suppress notable events Module 3 – Risk-Based Alerting - Give an overview of Risk-Based Alerting - View Risk Notables and risk information on the Incident Review dashboard - Explain risk scores and how to change an object's risk score - Review the Risk Analysis dashboard - Describe annotations - Describe the process for retrieving LDAP data for an asset or identity lookup Module 4 – Assets & Identities - Give an overview of the ES Assets and Identities framework - Show examples where asset or identity data is missing from ES dashboards or notable events - View the Asset & Identity Management Interface - View the contents of an asset or identity lookup table Module 5 – Investigations - Use investigations to manage incident response activity - Use the investigation workbench to manage, visualize and coordinate incident investigations - Add various items to investigations (notes, action history, collaborators, events, assets, identities, files and URLs) - Use investigation timelines, lists and summaries to document and review breach analysis and mitigation efforts Module 6 – Security Domain Dashboards - Describe the ES security domains - Use the Security Domain dashboards to troubleshoot various security threats - Learn how to launch the Security Domain dashboards from Incidents Review and from a notable event Action menu Module 7 – User Intelligence - Understand and use user activity analysis - Use investigators to analyze events related to an asset or identity - Use access anomalies to detect suspicious access patterns Module 8 – Web Intelligence - Use the web intelligence dashboards to analyze your network environment - Filter and highlight events Module 9 – Threat Intelligence - Give an overview of the Threat Intelligence framework and how threat intel is configured in ES - Use the Threat Activity dashboard to see which threat sources are interacting with your environment - Use the Threat Artifacts dashboard to examine the status of threat intelligence information in your environment Module 10 – Protocol Intelligence - Explain how network data is input into Splunk events - Describe stream events - Give an overview of the Protocol Intelligence dashboards and how they can be used to analyze network dataModule 1 - Getting Started with ES - Describe the features and capabilities of Splunk Enterprise Security (ES) - Explain how ES helps security practitioners prevent, detect, and respond to threats - Describe correlation searches, data models and notable events - Describe user roles in ES - Log into Splunk Web and access Splunk for Enterprise Security Module 2 - Security Monitoring and Incident Investigation - Use the Security Posture dashboard to monitor ES status - Use the Incident Review dashboard to investigate notable events - Take ownership of an incident and move it through the investigation workflow - Create notable events - Suppress notable events Module 3 – Risk-Based Alerting - Give an overview of Risk-Based Alerting - View Risk Notables and risk information on the Incident Review dashboard - Explain risk scores and how to change an object's risk score - Review the Risk Analysis dashboard - Describe annotations - Describe the process for retrieving LDAP data for an asset or identity lookup Module 4 – Assets & Identities - Give an overview of the ES Assets and Identities framework - Show examples where asset or identity data is missing from ES dashboards or notable events - View the Asset & Identity Management Interface - View the contents of an asset or identity lookup table Module 5 – Investigations - Use investigations to manage incident response activity - Use the investigation workbench to manage, visualize and coordinate incident investigations - Add various items to investigations (notes, action history, collaborators, events, assets, identities, files and URLs) - Use investigation timelines, lists and summaries to document and review breach analysis and mitigation efforts Module 6 – Security Domain Dashboards - Describe the ES security domains - Use the Security Domain dashboards to troubleshoot various security threats - Learn how to launch the Security Domain dashboards from Incidents Review and from a notable event Action menu Module 7 – User Intelligence - Understand and use user activity analysis - Use investigators to analyze events related to an asset or identity - Use access anomalies to detect suspicious access patterns Module 8 – Web Intelligence - Use the web intelligence dashboards to analyze your network environment - Filter and highlight events Module 9 – Threat Intelligence - Give an overview of the Threat Intelligence framework and how threat intel is configured in ES - Use the Threat Activity dashboard to see which threat sources are interacting with your environment - Use the Threat Artifacts dashboard to examine the status of threat intelligence information in your environment Module 10 – Protocol Intelligence - Explain how network data is input into Splunk events - Describe stream events - Give an overview of the Protocol Intelligence dashboards and how they can be used to analyze network data2 jours1500.001250.001500.001500.001500.001500.001500.001500.001500.002070.001650.001500.00150.00150.00150.00150.00150.00150.00150.00150.00150.00150.00