Trending Courses

Vendors

Skip Navigation Links

Overview

This 13.5-hour course prepares security practitioners to use Splunk Enterprise Security (ES). Students identify and track incidents, analyze security risks, use predictive analytics, and discover threats.
img-course-overview.jpg

What You'll Learn

  • ES concepts, features, and capabilities
  • Security monitoring and Incident investigation
  • Using risk-based alerting and risk analysis
  • Assets and identities overview
  • Creating investigations and using the Investigation Workbench
  • Detecting known types of threats
  • Monitoring for new types of threats
  • Using analytical tools and dashboards
  • Analyze user behavior for insider threats
  • Use threat intelligence tools
  • Use protocol intelligence

Who Should Attend

  • Splunk Administrator
  • Developer
  • User
  • Knowledge Manager
  • Architect
img-who-should-learn.png

Prerequisites

To be successful, students should have a solid understanding of the following courses:

  • What is Splunk?
  • Intro to Splunk
  • Using Fields
  • Visualizations
  • Search Under the Hood
  • Intro to Knowledge Objects
  • Introduction to Dashboards

Learning Journey

Coming Soon...

Module 1 – Getting Started with ES

  • Describe the features and capabilities of Splunk Enterprise Security (ES)
  • Explain how ES helps security practitioners prevent, detect, and respond to threats
  • Describe correlation searches, data models, and notable events
  • Describe user roles in ES
  • Log into Splunk Web and access Splunk for Enterprise Security

Module 2 – Security Monitoring and Incident Investigation

  • Use the Security Posture dashboard to monitor ES status
  • Use the Incident Review dashboard to investigate notable events
  • Take ownership of an incident and move it through the investigation workflow
  • Create notable events
  • Suppress notable events

Module 3 – Risk-Based Alerting

  • Give an overview of Risk-Based Alerting
  • View Risk Notables and risk information on the Incident Review dashboard
  • Explain risk scores and how to change an object’s risk score
  • Review the Risk Analysis dashboard
  • Describe annotations
  • Describe the process for retrieving LDAP data for an asset or identity lookup

Module 4 – Assets & Identities

  • Give an overview of the ES Assets and Identities framework
  • Show examples where asset or identity data is missing from ES dashboards or notable events
  • View the Asset & Identity Management Interface
  • View the contents of an asset or identity lookup table

Module 5 – Investigations

  • Use investigations to manage incident response activity
  • Use the Investigation Workbench to manage, visualize and coordinate incident investigations
  • Add various items to investigations (notes, action history, collaborators, events, assets, identities, files and URLs)
  • Use investigation timelines, lists and summaries to document and review breach analysis and mitigation efforts

Module 6 – Security Domain Dashboards

  • Describe the ES security domains
  • Use the Security Domain dashboards to troubleshoot various security threats
  • Learn how to launch the Security Domain dashboards from Incident Review and from a notable event Action menu

Module 7 – User Intelligence

  • Understand and use user activity analysis
  • Use investigators to analyze events related to an asset or identity
  • Use access anomalies to detect suspicious access patterns

Module 8 – Web Intelligence

  • Use the web intelligence dashboards to analyze your network environment
  • Filter and highlight events

Module 9 – Threat Intelligence

  • Give an overview of the Threat Intelligence framework and how threat intel is configured in ES
  • Use the Threat Activity dashboard to see which threat sources are interacting with your environment
  • Use the Threat Artifacts dashboard to examine the status of threat intelligence information in your environment

Module 10 – Protocol Intelligence

  • Explain how network data is input into Splunk events
  • Describe stream events
  • Give an overview of the Protocol Intelligence dashboards and how they can be used to analyze network data

Frequently Asked Questions (FAQs)

  • Why get Splunk certified?

    Splunk certifications validate your expertise in data analytics and your proficiency in using the Splunk platform.

    These certifications demonstrate your ability to leverage Splunk's powerful tools for data collection, analysis, and visualization, making you a valuable asset to organizations seeking to gain actionable insights from their data.

    Splunk-certified professionals are in high demand across various industries, including IT, security, and business analytics.

  • What to expect for the examination?

    Splunk offers a variety of certification exams at different levels, covering various domains and products within the Splunk platform.

    Exams typically consist of multiple-choice and scenario-based questions that assess your knowledge and skills in using Splunk to solve real-world problems.

    Note: Certification requirements and policies may be updated by Splunk from time to time. We apologize for any discrepancies; do get in touch with us if you have any questions.

  • How long is Splunk certification valid for?

    All Splunk certifications are valid for three years from the date of passing the highest-level certification exam.

    To maintain your certification, you will need to recertify before it expires. You have three options for recertification:

    - Pursue a higher-level certification (including any required prerequisite courses), in which case your lower-level certifications would also be renewed on the date of passing the next-level certification exam.

    - Retake a certification exam within the final year of their recertification window to renew their certifications at that level (and any applicable downstream certifications).

    - Complete continuing education courses at any point in the three year recertification window beginning the date of badge issuance.

    Note: Certification requirements and policies may be updated by Splunk from time to time. We apologize for any discrepancies; do get in touch with us if you have any questions.

  • Why take this course with Trainocate?

    Here’s what sets us apart:

    - Global Reach, Localized Accessibility: Benefit from our geographically diverse training hubs in 24 countries (and counting!).

    - Top-Rated Instructors: Our team of subject matter experts (with high average CSAT and MTM scores) are passionate to help you accelerate your digital transformation.

    - Customized Training Solutions: Choose from on-site, virtual classrooms, or self-paced learning to fit your organization and individual needs.

    - Experiential Learning: Dive into interactive training with our curated lesson plans. Participate in hands-on labs, solve real-world challenges, and take on comprehensive assessments.

    - Learn From The Best: With 30+ authorized training partnerships and countless awards from Microsoft, AWS, Google – you're guaranteed learning from the industry's elite.

    - Your Bridge To Success: We provide up-to-date course materials, helpful exam guides, and dedicated support to validate your expertise and elevate your career.

Keep Exploring

Course Curriculum

Course Curriculum

Training Schedule

Training Schedule

Exam & Certification

Exam & Certification

FAQs

Frequently Asked Questions

img-improve-career.jpg

Improve yourself and your career by taking this course.

More Courses By Splunk

Browse All Courses
splk-pusrfs-splunk-power-user-fast-start-training
The Splunk Platform

Splunk Power User Fast Start

Trainocate’s Splunk Power User Fast Start (SPLK-PUSRFS) training teaches data analysis and visualization with Splunk. Earn certification in this hands-on course.
ILT VILT
Course Duration 4 Days
Fees ₹ 95,000.00
splk-sesa-splunk-enterprise-system-administration-training
The Splunk Platform

Splunk Enterprise System Administration

Trainocate’s Splunk Enterprise System Administration (SPLK-SESA) training teaches Splunk system deployment and management. Earn certification in this hands-on course.
ILT VILT
Course Duration 2 Days
Fees ₹ 36,100.00
splk-seda-splunk-enterprise-data-administration-training
The Splunk Platform

Splunk Enterprise Data Administration

Trainocate’s Splunk Enterprise Data Administration (SPLK-SEDA) training teaches data management and optimization in Splunk. Earn certification in this hands-on course.
ILT VILT
Course Duration 3 Days
Fees ₹ 54,150.00
img-get-info.jpg

Ready to Take Your Business from Great to Awesome?

Level-up by partnering with Trainocate. Get in touch today.

Name
Email
Phone
I'm inquiring for
Inquiry Details

By submitting this form, you consent to Trainocate processing your data to respond to your inquiry and provide you with relevant information about our training programs, including occasional emails with the latest news, exclusive events, and special offers.

You can unsubscribe from our marketing emails at any time. Our data handling practices are in accordance with our Privacy Policy.

Stay Connected. Be the first to Know.

Company

Vendors

Services

Customer Service

© Copyright Trainocate 2025. All rights reserved.