Administration Splunk Enterprise Security – Inhouse - Inhouse von ExperTeach Gesellschaft für Netzwerkkompetenz mbH

This 13.5 hour course prepares architects and systems administrators  to install and configure Splunk Enterprise Security (ES). It covers ES event processing and normalization, deployment requirements, technology add-ons, dashboard dependencies, data models, managing risk, and customizing threat intelligence.

• Introduction to ES
• Security Monitoring
• Risk-Based Alerting
• Incident Investigation
• Installation
• Initial Configuration
• Validating ES Data
• Custom Add-ons
• Tuning Correlation Searches
• Creating Correlation Searches
• Asset & Identity Management
• Managing Threat Intelligence

To be successful, students should have a solid understanding of the following:

If on-prem:

• Splunk Enterprise System Administration
• Splunk Enterprise Data Administration

If on cloud:

• Splunk Cloud Administration and
• What is Splunk?
• Creating Knowledge Objects
• Intro to Splunk
• Creating Field Extractions
• Using Fields
• Enriching Data with Lookups
• Visualizations
• Search Under the Hood
• Intro to Knowledge Objects
• Data Models
• Introduction to Dashboards