Administering Splunk Enterprise Security 5.3

Administering Splunk Enterprise Security 5.3

Summary

This 13.5 hour course prepares architects and systems administrators to install, configure and manage Splunk Enterprise Security. It covers ES event processing and normalization, deployment requirements, technology add-ons, settings, risk analysis settings, threat intelligence and protocol intelligence configuration, and customizations.

Description

Course Topics

  • Identify normal ES use cases
  • Examine deployment requirements for typical ES installs
  • Learn how to install ES and gather information for lookups
  • Learn the steps to setting up inputs using technology and add-ons
  • Create custom correlation searches
  • Configure ES risk analysis, threat and protocol intelligence
  • Fine tune ES settings and other customizations

Duration

3 Days

Objectives

Module 1 – Introduction to ES

  • Overview of ES features and concepts

Module 2 – Security Monitoring & Incident Investigation

  • Use the Security Posture and Incident Review dashboards
  • Manage Notable events
  • Work with Investigations

Module 3 – Analyst Tool & Data Sources;

  • Overview of security analyst tools

Module 4 – ES Deployment

  • Identify deployment topologies
  • Examine the deployment checklist
  • Understand indexing strategy for ES
  • Understand ES Data Models

Module 5 – Installation

  • Prepare a Splunk environment for installation
  • Download and install ES on a search head
  • Test a new install
  • Understand ES Splunk user accounts and roles
  • Post-install configuration tasks

Module 6 – Initial Configuration

  • Configure user roles and capabilities
  • Set general configuration options
  • Add external integrations
  • Configure local domain information

Module 7 – Validating ES Data

  • Verify data is correctly configured for use in ES
  • Validate normalization configurations
  • Install additional add-ons

Module 8 – Custom Add-ons

  • Design a new add-on for custom data
  • Use the Add-on Builder to build a new add-on

Module 9 – Tuning Correlation Searches

  • Configure correlation search scheduling and sensitivity
  • Tune ES correlation searches

Module 10 – Creating Correlation Searches

  • Create a custom correlation search
  • Manage adaptive responses
  • Export/import content

Module 11 – Lookups and Identity Management

  • Identify ES-specific lookups
  • Understand and configure lookup lists

Module 12 – Threat Intelligence Framework

  • Understand and configure threat intelligence
  • Configure a new threat list

Prerequisites

  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
  • Splunk System Administration
  • Splunk Data Administration
  • Architecting Splunk Enterprise Deployments (Strongly Recommended, but not required)

Onsite Training

For groups of three or more

Request Quote

Public Training

Ingeniq

AMER Eastern Time - Virtual

APAC Singapore - Virtual

AMER Pacific Time - Virtual

EMEA Coordinated Universal Time (GMT) - Virtual


Don't see a date that works for you?

Request Class