Using Splunk Enterprise Security (USES)

This 13.5-hour instructor-led course prepares SOC Analysts to use Splunk Enterprise Security (ES).Students identify and track incidents, analyze security risks, use predictive analytics, and discov...

Module 1 - ES Fundamentals


- Explain the function of a SIEM
- Give an overview of Splunk Enterprise Security (ES)
- Understand how ES uses data models
- Describe detections and findings
- Identify ES roles and permissions
- Give an overview of ES navigation
Module 2 - Exploring the Analyst Queue


- Explore the Analyst Queue
- Filtering
- Triage Findings and Finding Groups
- Create ad hoc Findings
- Suppress Findings from the Analyst Queue
Module 3 - Working with Investigations


- Give an overview of an investigation
- Demonstrate how to create an investigation
- Use Response Plans
- Add Splunk events to an investigation
- Use Playbooks and Actions
Module 4 - Risk-based Alerting


- Give an overview of risk and Risk-Based Alerting (RBA)
- Explain risk scores and how to change an entity's risk score
- Review the Risk Analysis dashboard
- Describe annotations
- View risk information in Analyst Queue findings
Module 5 - Assets & Identities


- Give an overview of the ES Assets and Identities (A&I) framework
- Show where asset or identity data is missing from ES findings or dashboards
- View the A&I Management Interface
- View the contents of an asset or identity lookup table
- I...

SOC Analysts.