Administering Splunk Enterprise Security 5.2

Administering Splunk Enterprise Security 5.2

Upcoming Classes

No classes have been scheduled.

Summary

This 13.5 hour course prepares architects and systems administrators to install, configure and manage Splunk Enterprise Security (ES). It covers ES event processing and normalization, deployment requirements, technology add-ons, settings, risk analysis settings, threat intelligence and protocol intelligence configuration, and customizations.

Description

Course Topics

  • Identify normal ES use cases
  • Examine deployment requirements for typical ES installs
  • Learn how to install ES and gather information for lookups
  • Learn the steps to set up inputs using technology and add-ons
  • Create custom correlation searches
  • Configure ES risk analysis, threat and protocol intelligence
  • Fine tune ES settings and other customizations

Duration

3 Days

Objectives

Module 1 – Introduction to ES

  • Overview of ES features and concepts

Module 2 – Security Monitoring & Incident Investigation

  • Use the Security Posture dashboard to monitor the statues of ES
  • Use the Incident Review dashboard to monitor the statues of ES
  • Take ownership of an incident and move it through the investigation workflow
  • Create notable events
  • Suppress notable events
  • Examine the investigation journal

Module 3 – Analyst Tool & Data Sources;

  • Identify ES security analyst tools
  • Map security tools to data sources
  • Examine management tools for analyste dashboards

Module 4 – ES Deployment

  • Identify deployment topologies
  • Examine the deployment checklist
  • Understand pre-deployment requirements

Module 5 – Installation

  • List ES pre-installation requirements
  • Identify steps for downloading and installing ES
  • Test a new install

Module 6 – Initial Configuration

  • List ES pre-installation requirements
  • Identify steps for downloading and installing ES
  • Test a new install

Module 7 – Validating ES Data

  • Verify data is correctly configured for use in ES
  • Validate normalization configurations
  • Install additional add-ons

Module 8 – Custom Add-ons

  • Use custom data in ES
  • Create an add-on for a custom sourcetype
  • Describe add-on troubleshooting

Module 9 – Tuning Correlation Searches

  • Describe correlation search operation
  • Customize correlation searches
  • Describe numeric vs. conceptual thresholds
  • Discuss the Event Sequencing Engine

Module 10 – Creating Correlation Searches

  • Create a custom correlation search
  • Manage adaptive responses
  • Manage content import and export

Module 11 – Lookups and Identity Management

  • Identify ES-specific lookups
  • Describe the interaction of lookups with correlation searches and other ES functions
  • Configure asset and identity lookups

Module 12 – Threat Intelligence Framework

  • Describe threat lists and threat list administration tools
  • Configure a new threat list

Prerequisites

  • Splunk System Administration
  • Splunk Data Administration
  • Splunk Enterprise Cluster Administration
  • Architecting Splunk Enterprise Deployments
  • Either, Advanced Searching and Reporting or Splunk Fundamentals 1 & 2

Onsite Training

For groups of three or more

Request Quote

Public Training