This 13.5-hour course prepares security practitioners to use Splunk Enterprise Security (ES). Students identify and track incidents, analyze security risks, use predictive analytics, and discover threats.

• ES concepts,features, and capabilities
• Assets and identities
• Security monitoring and Incident investigation
• Use risk-based alerting and risk analysis
• Use investigation workbench, timelines, list and summary tools
• Detecting known types of threats
• Monitoring for new types of threats
• Using analytical tools
• Analyze user behavior for insider threats
• Use threat intelligence tools
• Use protocol intelligence and live stream data

• Splunk Fundamentals 1
  
• Splunk Fundamentals 2
  

Or the following single-subject courses:

• What is Splunk?
• Intro to Splunk
• Using Fields
• Scheduling Reports and Alerts
• Visualizations
• Leveraging Lookups and Sub-searches
• Search Under the Hood
• Introduction to Knowledge Objects
• Enriching Data with Lookups
• Data Models
• Introduction to Dashboards

Module 1 - Getting Started with ES

• Describe the features and capabilities of Splunk Enterprise Security (ES)
• Explain how ES helps security practitioners prevent, detect, and respond to threats
• Describe correlation searches, data models and notable events
• Describe user roles in ES
• Log into Splunk Web and access Splunk for Enterprise Security

Module 2 - Security Monitoring and Incident Investigation

Module 3 – Risk-Based Alerting

Module 4 – Investigations

Module 5 – Using Security Domain Dashboards

Module 6 – Web Intelligence

Module 7 – User Intelligence

Module 8 – Threat Intelligence

Module 9 – Protocol Intelligence