Administering Splunk Enterprise Security (ASES)

This course is part of the following Certifications:

• Splunk Enterprise Security Certified Admin

Topic 1 – Introduction to ES

• Review how ES functions
• Understand how ES uses data models
• Configure ES roles and permissions

Topic 2 – Security Monitoring

• Customize the Security Posture and Incident Review dashboards
• Create ad hoc notable events
• Create notable event suppressions

Topic 3 – Risk-Based Alerting

• Give an overview of risk-based alerting
• View Risk Notables and risk information on the Incident Review dashboard
• Explain risk scores and how an ES admin can change an object's risk score
• Review the Risk Analysis dashboard
• Describe annotations

Topic 4 – Incident Investigation

• Review the Investigations dashboard
• Customize the Investigation Workbench
• Manage investigations

Topic 5 – Installation

• Prepare a Splunk environment for installation
• Download and install ES on a search head
• Test a new install
• Post-install configuration tasks

Topic 6 – Initial Configuration

• Set general configuration options
• Add external integrations
• Configure local domain information
• Customize navigation
• Configure Key Indicator searches

Topic 7 – Validating ES Data

• Verify data is correctly configured for use in ES
• Validate normalization configurations
• Install additional add-ons

Topic 8 – Custom Add-ons

• Design a new add-on for custom data
• Use the Add-on Builder to build a new add-on

Topic 9 – Tuning Correlation Searches

• Configure correlation search scheduling and sensitivity
• Tune ES correlation searches

Topic 10 – Creating Correlation Searches

• Create a custom correlation search
• Manage adaptive responses
• Export/import content

Topic 11 – Asset & Identity Management

• Review the Asset and Identity Management interface
• Describe Asset and Identity KV Store collections
• Configure and add asset and identity lookups to the interface
• Configure settings and fields for asset and identity lookups
• Explain the asset and identity merge process
• Describe the process for retrieving LDAP data for an asset or identity lookup

Topic 12 – Threat Intelligence Framework

• Understand and configure threat intelligence
• Use the Threat Intelligence Management interface to configure a new threat list