Administering Splunk Enterprise Security 6.1

Administering Splunk Enterprise Security 6.1

Administering Splunk Enterprise Security 6.1

Upcoming Classes

Online

Instructor-led online training

Location May 2020 Jun 2020 Jul 2020 Aug 2020 Sep 2020 Oct 2020 Nov 2020
EMEA UK Time - Virtual Jun 3 – Jun 5
Jun 10 – Jun 12
Jun 17 – Jun 19
Jun 24 – Jun 26
 Jul 1 – Jul 3
Jul 8 – Jul 10
Jul 15 – Jul 17
Jul 22 – Jul 24
Jul 29 – Jul 31
 Aug 5 – Aug 7
Aug 12 – Aug 14
Aug 19 – Aug 21
Aug 26 – Aug 28
 Sep 2 – Sep 4
Sep 9 – Sep 11
Sep 16 – Sep 18
Sep 23 – Sep 25
Sep 30 – Oct 2
 Oct 7 – Oct 9
Oct 7 – Oct 9
Oct 14 – Oct 16
APAC Singapore - Virtual Jun 3 – Jun 5
 Jul 15 – Jul 17
 Sep 2 – Sep 4
 Oct 14 – Oct 16
AMER Pacific Time - Virtual Jun 17 – Jun 19
 Jul 8 – Jul 10
Jul 15 – Jul 17
Jul 29 – Jul 31
 Aug 5 – Aug 7
Aug 19 – Aug 21
 Sep 2 – Sep 4
Sep 16 – Sep 18
Sep 30 – Oct 2
 Oct 7 – Oct 9
Oct 28 – Oct 30
AMER Eastern Time - Virtual Jun 24 – Jun 26
 Jul 8 – Jul 10
Jul 22 – Jul 24
 Aug 12 – Aug 14
Aug 26 – Aug 28
 Sep 2 – Sep 4
Sep 9 – Sep 11
Sep 23 – Sep 25
Sep 30 – Oct 2
 Oct 14 – Oct 16

Summary

This 13.5 hour course prepares architects and systems administrators to install, configure and manage Splunk Enterprise Security. It covers ES event processing and normalization, deployment requirements, technology add-ons, settings, risk analysis settings, threat intelligence and protocol intelligence configuration, and customizations.

Description

Course Topics

  • Examine how Enterprise Security functions including data models, correlation searches, notable events and dashboards
  • Learn how to install ES and gather information for lookups
  • Learn the steps to setting up inputs using technology add-ons
  • Create custom correlation searches
  • Configure ES risk analysis, threat and protocol intelligence
  • Fine tune ES settings and other customizations

Duration

3 Days

Objectives

Module 1 – Introduction to ES

  • Overview of ES features and concepts
  • Configure ES roles and permissions

Module 2 – Security Monitoring

  • Use the Security Posture and Incident Review dashboards
  • Manage Notable events

Module 3 – Incident Investigation

  • Review the Investigation dashboard and Investigation workbench
  • Create and manage investigations
  • Customize the Investigation Workbench

Module 4 – Analyst Tool & Data Sources;

  • Overview of security analyst tools
  • Troubleshoot dashboard dependencies
  • Give an overview of Glass Tables

Module 5 – ES Deployment

  • Identify deployment topologies
  • Examine the deployment checklist
  • Understand indexing strategy for ES
  • Understand ES Data Models

Module 6 – Installation

  • Prepare a Splunk environment for installation
  • Download and install ES on a search head
  • Test a new install
  • Post-install configuration tasks

Module 7 – Initial Configuration

  • Set general configuration options
  • Add external integrations
  • Configure local domain information

Module 8 – Validating ES Data

  • Verify data is correctly configured for use in ES
  • Validate normalization configurations
  • Install additional add-ons

Module 9 – Custom Add-ons

  • Design a new add-on for custom data
  • Use the Add-on Builder to build a new add-on

Module 10 – Tuning Correlation Searches

  • Configure correlation search scheduling and sensitivity
  • Tune ES correlation searches
  • Discuss the Event Sequencing Engine

Module 11 – Creating Correlation Searches

  • Create a custom correlation search
  • Manage adaptive responses
  • Export/import content

Module 12 – Asset and Identity Management

  • Identify ES-specific lookups
  • Understand and configure lookup lists
  • Configure asset and identity lookups

Module 13 – Threat Intelligence Framework

  • Understand and configure threat intelligence
  • Configure a new threat list

Prerequisites

  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
  • Splunk System Administration
  • Splunk Data Administration

Onsite Training

For groups of three or more

Request Quote

Public Training

EMEA UK Time - Virtual

APAC Singapore - Virtual

AMER Pacific Time - Virtual

AMER Eastern Time - Virtual


Don't see a date that works for you?

Request Class

© 2005- Splunk Inc. All rights reserved.
Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © Splunk Inc. All rights reserved.