Administration Splunk Enterprise Security (ASESGE)

Ziele der Schulung

This 13.5 hour course prepares architects and systems administrators to install and configure Splunk Enterprise Security (ES). It covers ES event processing and normalization, deployment requirements, technology add-ons, dashboard dependencies, data models, managing risk, and customizing threat intelligence

Zielgruppe Seminar

• Splunk Enterprise Security Administratoren Personen, die ES installieren, konfigurieren, warten und optimieren.
• SOC-Analysten / Security Engineers die mit Korrelationssuchen, Risk-Based Alerting, Incident Investigation und Threat Intelligence arbeiten.
• Splunk Platform Administratoren die bereits Splunk Enterprise oder Splunk Cloud administrieren und auf ES erweitern.
• Security Architects / Detection Engineers die eigene Use Cases, Correlation Searches und Add-ons entwickeln.

Voraussetzungen

To be successful, students should have a solid understanding of the following:

If on-prem:

• Splunk Enterprise System Administration
• Splunk Enterprise Data Administration

If on cloud:

• Splunk Cloud Administration

and

• What is Splunk?
• Creating Knowledge Objects
• Intro to Splunk
• Creating Field Extractions
• Using Fields
• Enriching Data with Lookups
• Visualizations
• Search Under the Hood
• Intro to Knowledge Objects
• Data Models
• Introduction to Dashboards

Seminarinhalt

Module 1 – Introduction to ES

• Review how ES functions
• Understand how ES uses data models
• Configure ES roles and permissions

Module 2 – Security Monitoring

• Customize the Security Posture and Incident Review dashboards
• Create ad hoc notable events
• Create notable event suppressions

Module 3 – Risk-Based Alerting

• Explain Risk-Based Alerting
• Explain risk scores
• Review the Risk Analysis dashboard
• Use annotations
• Explain ways to assign risk

Module 4 – Incident Investigation

• Review the Investigations dashboard
• Customize the Investigation Workbench
• Manage investigations

Module 5 – Installation

• Prepare a Splunk environment for installation
• Download and install ES on a search head
• Test a new install
• Post-install configuration tasks

Module 6 – Initial Configuration

• Set general configuration options
• Add external integrations
• Configure local domain information
• Customize navigation
• Configure Key Indicator searches

Module 7 – Validating ES Data

• Verify data is correctly configured for use in ES
• Validate normalization configurations
• Install additional add-ons

Module 8 – Custom Add-ons

• Design a new add-on for custom data
• Use the Add-on Builder to build a new add-on

Module 9 – Tuning Correlation Searches

• Configure correlation search scheduling and sensitivity
• Tune ES correlation searches

Module 10 – Creating Correlation Searches

• Create a custom correlation search
• Manage adaptive responses
• Export/import content

Module 11 – Asset & Identity Management

• Review the Asset and Identity Management interface
• Describe Asset and Identity KV Store collections
• Configure and add asset and identity lookups to the interface
• Configure settings and fields for asset and identity lookups
• Explain the asset and identity merge process
• Describe the process for retrieving LDAP data for an asset or identity lookup

Module 12 – Managing Threat Intelligence

• Understand and configure threat intelligence Splunk Education Services
• Use the Threat Intelligence Management interface to configure a new threat list

Hinweise

Partner

Dieses Seminar bieten wir in Kooperation mit unserem Splunk Learning Partner Fast Lane Institute for Knowledge Transfer GmbH an.

Open Badge für dieses Seminar - Ihr digitaler Kompetenznachweis

Durch die erfolgreiche Teilnahme an einem Kurs bei IT-Schulungen.com erhalten Sie zusätzlich zu Ihrem Teilnehmerzertifikat ein digitales Open Badge (Zertifikat) – Ihren modernen Nachweis für erworbene Kompetenzen.

Ihr Open Badge ist jederzeit in Ihrem persönlichen und kostenfreien Mein IT-Schulungen.com-Konto verfügbar. Mit wenigen Klicks können Sie diesen digitalen Nachweis in sozialen Netzwerken teilen, um Ihre Expertise sichtbar zu machen und Ihr berufliches Profil gezielt zu stärken.

Übersicht: Splunk Schulungen Portfolio

Mehr zu den Vorteilen von Badges