Investigating Incidents with Splunk SOAR
Upcoming Classes
Online
Instructor-led online training
| Location | Oct 2022 | Nov 2022 | Dec 2022 | Jan 2023 | Feb 2023 | Mar 2023 | Apr 2023 |
|---|---|---|---|---|---|---|---|
| APAC Singapore - Virtual |
Oct 6 |
Nov 25 |
Jan 2 | ||||
| EMEA UK Time - Virtual |
Oct 17 |
Nov 28 |
Jan 9 | ||||
| AMER Pacific Time - Virtual |
Nov 1 |
Dec 12 |
Jan 27 | ||||
| AMER Eastern Time - Virtual |
Nov 21 |
Dec 19 |
Jan 6 Jan 27 |
Summary
This 3 hour course prepares security practitioners to use SOAR to respond to security incidents, investigate vulnerabilities, and take action to mitigate and prevent security problems.
Objectives
Topic 1 – Starting Investigations
- SOAR investigation concepts
- ROI view
- Using the Analyst Queue
- Using indicators
- Using search
Topic 2 – Working on Events
- Using the investigation page to work on events
- Use the heads-up display
- Set event status and other fields
- Use notes and comments
- How SLA affects event workflow
- Using artifacts and files
- Exporting events
- Executing actions and playbooks
- Managing approvals
Topic 3 – Cases: Complex Events
- Use case management for complex investigations
- Use case workflows
- Mark evidence
- Running reports
Public Training
APAC Singapore - Virtual
-
9:00 AM - 12:30 PM SGT$ 500.00 USD -
9:00 AM - 12:00 PM SGT$ 500.00 USD
-
9:00 AM - 12:00 PM SGT$ 500.00 USD
EMEA UK Time - Virtual
-
9:00 AM - 12:00 PM BST$ 500.00 USD
-
9:00 AM - 12:00 PM GMT$ 500.00 USD
-
9:00 AM - 12:00 PM GMT$ 500.00 USD
AMER Pacific Time - Virtual
-
9:00 AM - 12:00 PM PDT$ 500.00 USD
-
9:00 AM - 12:00 PM PST$ 500.00 USD
-
9:00 AM - 12:00 PM PST$ 500.00 USD
AMER Eastern Time - Virtual
-
9:00 AM - 12:00 PM EST$ 500.00 USD
-
9:00 AM - 12:00 PM EST$ 500.00 USD
-
9:00 AM - 12:00 PM EST$ 500.00 USD
-
9:00 AM - 12:00 PM EST$ 500.00 USD
Don't see a date that works for you?
