Splunk for Security Analytics and Monitoring
3h 19mIntermediate2022-12-02
Authors
Daniel Lachance
Consultant, Trainer, Author, and Editor at Lachance IT Consulting
Course details
Splunk offers IT technicians a single-pane inventory, performance and security monitoring interface for on-premises and cloud-based devices, servers, apps and services. In this course, learn how to plan the deployment and management of a Splunk ecosystem to provide a centralized way to monitor the performance and security of on-premises and cloud-based IT devices and software services.
Instructor Daniel Lachance shows you how to deploy Splunk servers on-premises and in the cloud followed by configuring a variety of data sources such as Microsoft Active Directory and LInux log files, to forward their events to a Splunk indexer. Then, work with the Splunk web GUI, perform queries, manage dashboards, reports and alerts, and learn how to use playbooks to automate event workflows.
Instructor Daniel Lachance shows you how to deploy Splunk servers on-premises and in the cloud followed by configuring a variety of data sources such as Microsoft Active Directory and LInux log files, to forward their events to a Splunk indexer. Then, work with the Splunk web GUI, perform queries, manage dashboards, reports and alerts, and learn how to use playbooks to automate event workflows.
Skills covered
SplunkSoftware Quality AssuranceData EngineeringData ScienceSoftware DevelopmentOne-Off
Concepts
0. Introduction
- 01 - Splunk explained
- 02 - What you should know
1. The Splunk Ecosystem
- 03 - SIEM and SOAR overview
- 04 - Splunk overview
- 05 - Splunk components
- 06 - Splunk data ingestion
2. Deploying Splunk
- 07 - Splunk deployment planning
- 08 - Installing Splunk on Linux
- 09 - Installing Splunk on Windows
- 10 - Splunk users and roles
- 11 - Using the Splunk web GUI
- 12 - Using the Splunk CLI
3. Splunk and the Cloud
- 13 - Deploying the AWS Splunk AMI
- 14 - Deploying Splunk Cloud
4. Splunk Data Ingestion
- 15 - Forwarding Linux logs to Splunk
- 16 - Forwarding Windows log events to Splunk
- 17 - Monitoring Windows files
- 18 - Monitoring Windows printers
- 19 - Configuring Snort IDS alerts for Splunk
- 20 - Configuring an HTTP Event Collector (HEC)
- 21 - Forwarding Microsoft AD events to Splunk Cloud
5. Splunk Insights
- 22 - Splunk searching overview
- 23 - Performing Splunk queries
- 24 - Working with Splunk dashboards and reports
- 25 - Managing Splunk alerts
Conclusion
- 26 - What's next
Related courses
- Introduction to Security Information and Event Management (SIEM)
- Splunk Core Certified User (SPLK-1001) Cert Prep
- Introduction to SecOps on Google Distributed Cloud (GDC) by Google
- SecOps on Google Distributed Cloud (GDC) for Tier 3 Analysts by Google
- Automated Threat Detection: Building SOC Solutions with Splunk, TheHive, and Snort
- Network Forensics (2019)
- SIEM: Event Management with Splunk Security
- Learning Splunk