Administering Splunk Enterprise Security 6.4

Administering Splunk Enterprise Security 6.4

Administering Splunk Enterprise Security 6.4

Upcoming Classes

Online

Instructor-led online training

Location Feb 2021 Mar 2021 Apr 2021 May 2021 Jun 2021 Jul 2021 Aug 2021
AMER Eastern Time - Virtual Mar 3 – Mar 5
Mar 31 – Apr 2
 Apr 7 – Apr 9
Apr 14 – Apr 16
Apr 28 – Apr 30
 May 12 – May 14
May 12 – May 14
May 26 – May 28
 Jun 2 – Jun 4
Jun 9 – Jun 11
Jun 23 – Jun 25
 Jul 14 – Jul 16
Jul 21 – Jul 23
Jul 28 – Jul 30
 Aug 4 – Aug 6
Aug 18 – Aug 20
Aug 25 – Aug 27
EMEA UK Time - Virtual Mar 3 – Mar 5
Mar 10 – Mar 12
Mar 24 – Mar 26
 Apr 7 – Apr 9
Apr 21 – Apr 23
Apr 28 – Apr 30
 May 5 – May 7
May 12 – May 14
May 19 – May 21
 Jun 2 – Jun 4
Jun 9 – Jun 11
Jun 23 – Jun 25
 Jul 7 – Jul 9
Jul 21 – Jul 23
Jul 28 – Jul 30
 Aug 4 – Aug 6
Aug 11 – Aug 13
Aug 25 – Aug 27
AMER Pacific Time - Virtual Mar 10 – Mar 12
Mar 24 – Mar 26
 Apr 7 – Apr 9
Apr 21 – Apr 23
 May 5 – May 7
May 19 – May 21
 Jun 2 – Jun 4
Jun 16 – Jun 18
Jun 30 – Jul 2
 Jul 14 – Jul 16
 Aug 11 – Aug 13
Aug 25 – Aug 27
APAC Singapore - Virtual Mar 17 – Mar 19
 Apr 21 – Apr 23
 May 19 – May 21
 Jun 9 – Jun 11
 Jul 21 – Jul 23
 Aug 25 – Aug 27

Australia

Location Feb 2021 Mar 2021 Apr 2021 May 2021 Jun 2021 Jul 2021 Aug 2021
Ingeniq - Online Apr 19 – Apr 21
 Jun 23 – Jun 25
 Aug 25 – Aug 27

Summary

This 13.5 hour course prepares architects and systems administrators to install and configure Splunk Enterprise Security (ES). It covers ES event processing and normalization, deployment requirements, technology add-ons, dashboard dependencies, data models, managing risk, and customizing threat intelligence.

Description

Course Topics

  • Examine how ES functions including data models, correlation searches, notable events and dashboards
  • Create custom correlation searches
  • Customize the Investigation Workbench
  • Learn how to install or upgrade ES
  • Learn the steps to setting up inputs using technology add-ons
  • Fine tune ES Global Settings
  • Customize risk and configure threat intelligence

Duration

3 Days

Objectives

Module 1 – Introduction to ES

  • Review how ES functions
  • Understand how ES uses data models
  • Configure ES roles and permissions

Module 2 – Security Monitoring

  • Customize the Security Posture and Incident Review dashboards
  • Create ad hoc notable events
  • Create notable event suppressions

Module 3 – Incident Investigation

  • Review the Investigations dashboard
  • Customize the Investigation Workbench
  • Manage investigations

Module 4 – Analyst Tool & Data Sources;

  • Troubleshoot missing dashboard data
  • Explain dashboard dependencies including data models and searches
  • Give an overview of risk
  • Review the Risk Analysis dashboard
  • Explain ways to assign risk

Module 5 – ES Deployment

  • Identify on-prem deployment topologies
  • Examine the deployment checklist
  • Understand pre-deployment requirements

Module 6 – Installation

  • Prepare a Splunk environment for installation
  • Download and install ES on a search head
  • Test a new install
  • Post-install configuration tasks

Module 7 – Initial Configuration

  • Set general configuration options
  • Add external integrations
  • Configure local domain information
  • Customize navigation
  • Configure Key Indicator searches

Module 8 – Validating ES Data

  • Verify data is correctly configured for use in ES
  • Validate normalization configurations
  • Install additional add-ons

Module 9 – Custom Add-ons

  • Design a new add-on for custom data
  • Use the Add-on Builder to build a new add-on

Module 10 – Tuning Correlation Searches

  • Configure correlation search scheduling and sensitivity
  • Tune ES correlation searches

Module 11 – Creating Correlation Searches

  • Create a custom correlation search
  • Manage adaptive responses
  • Export/import content

Module 12 – Asset and Identity Management

  • Review the Asset and Identity Management interface
  • Describe Asset and Identity KV Store Collections
  • Configure and add asset and identity lookups to the interface
  • Configure settings and fields for asset and identify lookups
  • Explain the asset and identity merge process
  • Describe the process for retrieving LDAP data for an asset or identity lookup

Module 13 – Threat Intelligence Framework

  • Understand and configure threat intelligence
  • Use the Threat Intelligence Management interface to configure a new threat list

Prerequisites

  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
  • Splunk Enterprise System Administration
  • Splunk Enterprise Data Administration

Onsite Training

For groups of three or more

Request Quote

Public Training

AMER Eastern Time - Virtual

EMEA UK Time - Virtual

AMER Pacific Time - Virtual

APAC Singapore - Virtual

Chatswood, NSW


Don't see a date that works for you?

Request Class

© 2005- Splunk Inc. All rights reserved.
Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © Splunk Inc. All rights reserved.