Module 1 – Introduction to ES

• Overview of ES features and concepts
• Configure ES roles and permissions

Module 2 – Security Monitoring

• Use the Security Posture and Incident Review dashboards
• Manage Notable events

Module 3 – Incident Investigation

• Review the Investigation dashboard and Investigation workbench
• Create and manage investigations
• Customize the Investigation Workbench

Module 4 – Analyst Tool & Data Sources;

• Overview of security analyst tools
• Troubleshoot dashboard dependencies
• Give an overview of Glass Tables

Module 5 – ES Deployment

• Identify deployment topologies
• Examine the deployment checklist
• Understand indexing strategy for ES
• Understand ES Data Models

Module 6 – Installation

• Prepare a Splunk environment for installation
• Download and install ES on a search head
• Test a new install
• Post-install configuration tasks

Module 7 – Initial Configuration

• Set general configuration options
• Add external integrations
• Configure local domain information

Module 8 – Validating ES Data

• Verify data is correctly configured for use in ES
• Validate normalization configurations
• Install additional add-ons

Module 9 – Custom Add-ons

• Design a new add-on for custom data
• Use the Add-on Builder to build a new add-on

Module 10 – Tuning Correlation Searches

• Configure correlation search scheduling and sensitivity
• Tune ES correlation searches
• Discuss the Event Sequencing Engine

Module 11 – Creating Correlation Searches

• Create a custom correlation search
• Manage adaptive responses
• Export/import content

Module 12 – Asset and Identity Management

• Identify ES-specific lookups
• Understand and configure lookup lists
• Configure asset and identity lookups

Module 13 – Threat Intelligence Framework

• Understand and configure threat intelligence
• Configure a new threat list

• Splunk Fundamentals 1
• Splunk Fundamentals 2
• Splunk System Administration
• Splunk Data Administration