Tuning and Creating Correlation Searches in Splunk Enterprise Security
|
Learn to plan, design, develop, tune, and deploy correlation searches in Splunk Enterprise Security v6. Understand and manage ES-specific lookups as well as setting up the Asset and Identity framework for data enrichment and helping investigations.
Splunk Enterprise Security uses correlation searches to provide visibility into security-related threats and vulnerabilities, and generates notable events to track identified threats. In this course, Tuning and Creating Correlation Searches in Splunk Enterprise Security, you will gain the ability to create and tune correlation searches in Splunk Enterprise Security. First, you will learn how to tune and customize available correlation searches in Splunk Enterprise Security as well as plan, create, and deploy custom correlation searches specific to your environment. Next, you will discover ES-specific lookups and learn how to create and customize them. Finally, you will explore how to setup and manage assets and identities in Splunk ES for data enrichment purposes. When you are finished with this course, you will have the skills and knowledge of tuning and creating correlation searches needed to administer the incident management, and assets and identity frameworks of Splunk Enterprise Security.
Author Name: Muhammad Awan
Author Description:
Muhammad Awan is a Senior Splunk Admin in working in Public Sector. Has been associated with Splunk and data science related technologies for a decade. Splunk Certified Admin and Splunk Certified Power User. Microsoft Certified Solutions Exert and Microsoft Certified Solutions Associate (Office 365) MCSA (Messaging). Experience with Networks and Security technologies. He has been mentoring and teaching at various universities as a visiting faculty in the past. Loves to acquire new skills and dis… more
Table of Contents
- Course Overview
3mins - The Anatomy and Functions of Correlation Searches
17mins - Tuning Correlation Searches
40mins - Creating Correlation Searches
26mins - Importing and Exporting Correlation Searches
14mins - Implementing ES-specific Lookups and Managing Identities
60mins - Summary
2mins
User Reviews
Be the first to review “Tuning and Creating Correlation Searches in Splunk Enterprise Security”
Related Products
Creating Security Baselines in Microsoft Azure
This course will teach you about Security Baselines, which are part of the Microsoft Cloud Adoption Framework for Azure. You'll learn how to identify security risks, create policy statements to address them, and implement secure designs in Azure.
Building and Leading an Effective Threat Modeling Program
If you've seen the benefits of threat modeling in action and want to take this popular security approach to the next level, then this course will teach you how to plan, execute, and manage a threat modeling program at scale within your organization.
Credential Access with John the Ripper
John the Ripper (JtR) is widely used within red team assessments. Learn how to leverage the powerful capabilities of JtR to crack passwords of various hash types and use JtR within Metasploit.
Malware Analysis: Identifying and Defeating Code Obfuscation
Malware authors routinely utilize obfuscation techniques to complicate the analysis of their code. This course will teach you techniques for identifying and defeating code obfuscation so that key characteristics and behaviors can be identified.
Cisco Enterprise Networks: Infrastructure Security
In this course, you'll learn how to configure DHCP snooping, IP source guard, dynamic ARP inspection (DAI), port security, storm control, RADIUS, and TACACS+.
Getting Started with Keycloak
Adding SSO-friendly authentication and authorization to your applications using Keycloak doesn't have to be hard. Learn how to do a better job securing your apps by controlling access without spending weeks figuring it all out.
There are no reviews yet.