- Free Courses
-
Learning Paths
- Courses for Users
- Courses for Splunk Administrators
- Courses for Splunk Cloud Customers
-
Courses for Splunk Architects
- Overview
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Advanced Searching and Reporting
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Advanced Dashboards and Visualizations
- Architecting Splunk Enterprise Deployments
- Courses for App Developers
- Courses for Enterprise Security Administrators
- Courses for Enterprise Security End-Users
- Courses for IT Service Intelligence Administrators
- Courses for IT Service Intelligence End-Users
- Certification Tracks
-
Courses
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Advanced Searching and Reporting
- Advanced Dashboards and Visualizations
- Building Splunk Apps
- Splunk for Analytics and Data Science
- Splunk Infrastructure Overview
- Splunk Enterprise System Administration
- Splunk Enterprise Data Administration
- Troubleshooting Splunk Enterprise
- Splunk Enterprise Cluster Administration
- Splunk Cloud Administration
- Architecting Splunk Enterprise Deployments
- Splunk Enterprise Practical Lab
- Developing with Splunk's REST API
- Administering Splunk Enterprise Security
- Using Splunk Enterprise Security
- Implementing Splunk IT Service Intelligence
- Using Splunk IT Service Intelligence
- Splunk User Behavior Analytics
-
Videos
- All Videos
- Splunk Cloud Tutorial
- Installing Splunk Enterprise 6 on Linux
- Installing Splunk Enterprise 6 on Windows
- Getting Data In to Splunk Enterprise (Linux)
- Getting Data In (Windows)
- Getting Data In with Forwarders
- Basic Search in Splunk Enterprise 6.3
- Create a Dashboard in Splunk Enterprise
- Using the Splunk MINT SDK for Android
- Using the Splunk MINT SDK for iOS
- Basic Search in Splunk Light
- Create Reports in Splunk Light
- Create Dashboards in Splunk Light
- Create Alerts in Splunk Light
- FAQ
-
- Recertification
- Download Fact Sheet
Course Description
This 13.5 hour course prepares architects and systems administrators to install, configure and manage Splunk Enterprise Security. It covers ES event processing and normalization, deployment requirements, technology add-ons, settings, risk analysis settings, threat intelligence and protocol intelligence configuration, and customizations.
Instructor-led Training Schedule
| Start Date | Start Time | Time Zone | |
|---|---|---|---|
| 07-Nov-18 | 09:00 AM | (GMT+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna |
- Splunk Fundamentals 1
- Splunk Fundamentals 2
- Splunk System Administration
- Splunk Data Administration
- Architecting Splunk Enterprise Deployments
- Transforming commands and visualization
- Filtering and formatting
- Results
- Correlating events
- Knowledge objects
- Fields (Field aliases, field extractions, calculated fields)
- Tags and event types
- Macros
- Workflow actions
- Data models
- Splunk Common Information Model (CIM)
Course Objectives
- Overview of ES features and concepts
- Security Posture
- Incident Review
- Notable events management
- Overview of security intel tools
- Explore forensics dashboards
- Examine glass tables
- Configure navigation and dashboard permissions
- Identify deployment topologies
- Examine the deployment checklist
- Understand indexing strategy for ES
- Understand ES Data Models
- Prepare a Splunk environment for installation
- Download and install ES on a search head
- Test a new install
- Understand ES Splunk user accounts and roles
- Post-install configuration tasks
- Plan ES inputs
- Configure technology add-ons
- Design a new add-on for custom data
- Use the Add-on Builder to build a new add-on
- Configure correlation search scheduling and sensitivity
- Tune ES correlation searches
- Create a custom correlation search
- Configuring adaptive responses
- Search export/import
- Identify ES-specific lookups
- Understand and configure lookup lists
- Understand and configure threat intelligence
- Configure user activity analysis