Course Overview
This 13.5-hour instructor-led course enables SOC Engineers to use Splunk’s Enterprise Security SIEM for detection engineering, incident response, automation, asset and identity configuration, and threat intelligence management. Other topics include ES event processing and normalization, managing risk, data models, deployment requirements, technology add-ons, and dashboard dependencies.
This course may be delivered over two or three days, with 13.5 total hours of content.
Who should attend
This course is for ES Administrators and Engineers.
Certifications
This course is part of the following Certifications:
Prerequisites
To further support understanding of course concepts, the following additional courses or knowledge may be beneficial:
- Intro to Splunk
- Using Fields (SUF)
- Visualizations
- Search Under the Hood
- Intro to Knowledge Objects
- Creating Knowledge Objects (CKO)
- Creating Field Extractions (CFE)
- Enriching Data with Lookups (EDL)
- Data Models (SDM)
- Introduction to Dashboards (ITD)
- Splunk Enterprise System Administration (SESA)
- Splunk Enterprise Data Administration (SEDA)
Follow On Courses
- Advanced SOAR Implementation (ASOARI)
- Administering Splunk Enterprise Security (ASES)
- Splunk Enterprise Data Administration (SEDA)
- Splunk Enterprise System Administration (SESA)
- Developing SOAR Playbooks (DSOARP)
- Administering Splunk SOAR (ASOAR)
- Investigating Incidents with Splunk SOAR (IISS)
- Using Splunk Enterprise Security (USES)
Outline: Administering Splunk Enterprise Security (ASES)
Module 1 - Detection Engineering
- Give an overview of ES detections and finding types
- Create Event-based detections using the Detection Editor
- Review the configuration of Finding-based detections
- Highlight the details of Detection Studio
Module 2 - Customizing the Analyst Queue and Findings
- Divide the Analyst Queue into Team-based Queues
- Create and use Views
- Customize the Analyst Queue
- Modify Urgency
- Create new Status values
- Add fields to Finding attributes
- Suppress Findings
- Create ad-hoc Findings
Module 3 - Custom Investigation Tools
- Create Investigation Types
- Design custom Response Plans
- Import/export response plans
- Give an overview of SOAR pairing
- Create Automation Rules to automatically run a playbook when a detection produces findings
Module 4 - Asset & Identity Management
- Review the Asset and Identity Management interface
- Describe Asset and Identity KV Store collections
- Configure and add asset and identity lookups to the interface
- Configure settings and fields for asset and identity lookups
- Explain the asset and identity merge process
- Describe the process for retrieving LDAP data for an asset or identity lookup
- Review User and Entity Behavior Analytics (UEBA) and Exposure Analytics (EA)
Module 5 - Data Normalization
- Understand how ES uses accelerated data models
- Verify data is correctly configured for use in ES
- Validate normalization configurations
- Install additional add-ons
- Ingest custom data in ES
- Describe add-on troubleshooting
Module 6 - Risk-Based Alerting
- Give an overview of Risk-Based Alerting (RBA)
- Explain risk scores and how they can be changed by detections or manually
- Review the Risk analysis dashboard
- Understand Finding-based detections
- Describe annotations
- View risk information in Analyst Queue findings
Module 7 - Managing Threat Intelligence
- Review the Threat Intelligence Framework (TIF) and Threat Intelligence Management (TIM)
- Understand and configure threat intelligence
- Use the Threat Intelligence interface to configure threat lists