Administering Splunk Enterprise Security 6.1
Summary
This 13.5 hour course prepares architects and systems administrators to install, configure and manage Splunk Enterprise Security. It covers ES event processing and normalization, deployment requirements, technology add-ons, settings, risk analysis settings, threat intelligence and protocol intelligence configuration, and customizations.
Description
Course Topics
- Examine how Enterprise Security functions including data models, correlation searches, notable events and dashboards
- Learn how to install ES and gather information for lookups
- Learn the steps to setting up inputs using technology add-ons
- Create custom correlation searches
- Configure ES risk analysis, threat and protocol intelligence
- Fine tune ES settings and other customizations
Objectives
Module 1 – Introduction to ES
- Overview of ES features and concepts
- Configure ES roles and permissions
Module 2 – Security Monitoring
- Use the Security Posture and Incident Review dashboards
- Manage Notable events
Module 3 – Incident Investigation
- Review the Investigation dashboard and Investigation workbench
- Create and manage investigations
- Customize the Investigation Workbench
Module 4 – Analyst Tool & Data Sources;
- Overview of security analyst tools
- Troubleshoot dashboard dependencies
- Give an overview of Glass Tables
Module 5 – ES Deployment
- Identify deployment topologies
- Examine the deployment checklist
- Understand indexing strategy for ES
- Understand ES Data Models
Module 6 – Installation
- Prepare a Splunk environment for installation
- Download and install ES on a search head
- Test a new install
- Post-install configuration tasks
Module 7 – Initial Configuration
- Set general configuration options
- Add external integrations
- Configure local domain information
Module 8 – Validating ES Data
- Verify data is correctly configured for use in ES
- Validate normalization configurations
- Install additional add-ons
Module 9 – Custom Add-ons
- Design a new add-on for custom data
- Use the Add-on Builder to build a new add-on
Module 10 – Tuning Correlation Searches
- Configure correlation search scheduling and sensitivity
- Tune ES correlation searches
- Discuss the Event Sequencing Engine
Module 11 – Creating Correlation Searches
- Create a custom correlation search
- Manage adaptive responses
- Export/import content
Module 12 – Asset and Identity Management
- Identify ES-specific lookups
- Understand and configure lookup lists
- Configure asset and identity lookups
Module 13 – Threat Intelligence Framework
- Understand and configure threat intelligence
- Configure a new threat list