0
Shopping cart
( 0 items )
Remove all
Subtotal
(Before tax)
0
View Shopping Cart
Education Services
Education Services
Arrow Electronics, Inc.

Investigating Incidents with Splunk SOAR

CODE: SPL_IIWSS

LENGTH: 0,96 Hours (0,12 days)

PRICE: kr5 075,00

Expand all
Description

This 3 hour course prepares security practitioners to use SOAR to respond to security incidents, investigate vulnerabilities, and take action to mitigate and prevent security problems.

Objectives

  • SOAR concepts

  • Investigations

  • Running actions and playbooks

  • Case management & workflows

Programme

Topic 1 – Starting Investigations

  • SOAR investigation concepts

  • ROI view

  • Using the Analyst Queue

  • Using indicators

  • Using search

Topic 2 – Working on Events

  • Using the investigation page to work on events

  • Use the heads-up display

  • Set event status and other fields

  • Use notes and comments

  • How SLA affects event workflow

  • Using artifacts and files

  • Exporting events

  • Executing actions and playbooks

  • Managing approvals

    • Topic 3 – Cases: Complex Events

    • Use case management for complex investigations

    • Use case workflows

    • Mark evidence

    • Running reports

      • Session Dates