Skip to main content

Splunk Training + Certification

Administering Splunk SOAR

Course Description

This 3 hour course prepares IT professionals to configure and manage SOAR. 

 

Instructor-led Training Schedule

Prerequisite knowledge

  • Investigating incidents with Splunk SOAR

Course Topics

  • SOAR concepts
  • Initial configuration
  • Apps and assets
  • Configuring automation
  • User management
  • Ingesting data
  • Customization and monitoring

Course Objectives

Topic 1 –Initial Configuration
  • Describe SOAR operating concepts
  • Identify documentation and community resources
  • SOAR & Splunk Architecture
  • Product settings
  • Access control
  • Authentication settings
  • Response settings
  • Understanding roles
  • Creating users
  • Managing user access
 
Topic 2 –Apps, Assets and Playbooks
  • Add and configure apps and assets
  • Manage playbooks
  • Ingesting Data
  • Labels and tags
  • Event settings

 

Topic 3 –Customization and Monitoring
  • Create custom severity levels
  • Create custom status levels
  • Add custom fields and CEF settings
  • Create custom workbooks
  • Run reports
  • Use SOAR audit tools
  • Monitor system health