Module 1: Getting Started with ES

• Features and capabilities of Splunk Enterprise Security (ES)
• How ES aids security practitioners in threat prevention, detection, and response
• Correlation searches, data models, and notable events
• User roles in ES
• Logging into Splunk Web and accessing Splunk for Enterprise Security

Module 2: Security Monitoring and Incident Investigation

• Using the Security Posture dashboard for ES monitoring
• Investigating notable events using the Incident Review dashboard
• Incident ownership and investigation workflow
• Creating notable events
• Suppressing notable events

Module 3: Risk-Based Alerting

• Overview of Risk-Based Alerting
• Viewing Risk Notables and risk information on the Incident Review dashboard
• Understanding risk scores and changing object risk scores
• Risk Analysis dashboard
• Annotations
• Retrieving LDAP data for asset or identity lookup

Module 4: Assets & Identities

• ES Assets and Identities framework overview
• Identifying missing asset or identity data in ES dashboards or notable events
• Asset & Identity Management Interface
• Viewing asset or identity lookup table contents

Module 5: Investigations

• Managing incident response activity with investigations
• Using the Investigation Workbench for incident investigations
• Adding items to investigations (notes, action history, collaborators, events, assets, identities, files, and URLs)
• Utilizing investigation timelines, lists, and summaries for breach analysis

Module 6: Security Domain Dashboards

• Overview of ES security domains
• Using Security Domain dashboards to troubleshoot security threats
• Launching Security Domain dashboards from Incident Review and notable event Action menus

Module 7: User Intelligence

• User activity analysis and investigators
• Analyzing events related to assets or identities
• Detecting suspicious access patterns with access anomalies

Module 8: Web Intelligence

• Using web intelligence dashboards for network analysis
• Event filtering and highlighting

Module 9: Threat Intelligence

• Threat Intelligence framework overview and configuration in ES
• Utilizing the Threat Activity dashboard to track threat interactions
• Examining threat intelligence status with the Threat Artifacts dashboard

Module 10: Protocol Intelligence

• How network data is input into Splunk events
• Stream events and Protocol Intelligence dashboards for network data analysis

Using ES Course Prerequisites:

To succeed in this course, students should have a solid understanding of the following prerequisites:

• What is Splunk?
• Intro to Splunk
• Using Fields
• Visualizations
• Search Under the Hood
• Intro to Knowledge Objects
• Introduction to Dashboards