Duration
6 days
Overview
This program prepares security analysts and administrators to use Splunk Enterprise Security(ES). Students will use ES to identify and track security incidents, analyze security risks, use predictive analytics, and threat discovery.
Module 1 - Installing Splunk
- Splunking: What does it Mean
- How Should Splunk be Configured
- Identifying Splunk Instance Types
- Hardware Recommendations ñ Indexers
- Hardware Recommendations ñ Search Heads
- Splunk Install Packages
- Supported Platforms and Browsers
- Splunk Installation
- Splunk Directory Structure
- Restarting the Server from Splunk Web
- The Splunk Command Line Interface
- *NIX ñ Run Splunk at Boot
- Splunk Windows Services
- Splunk Processes : Splunkd
- Splunk Processes : Splunk Web
- Apps Installed by Default
- System Settings
- Describing General Settings
- Adding an Input With Splunk Web
- How can you tell what App you are in
- Adding your Monitor Input
- Preview Data
- Specify the Source
- Select Host, Sourcetype and Index
Module 2 - License Management
- Managing Licenses
- Splunk License Types
- Adding a License
- License Warnings and violations
- What Counts As Daily License Quota
- Viewing Alerts
- License Staking
- Master License Server
- License Pooling
Module 7 - Overview of Inputs
- Manual vs. Automatic Sourcetyping
- What is an App
- Apps configured by Default
- Viewing All Apps
- Managing Apps
- Installing an App Manually
- Enabling and Disabling Apps
- Deleting an App
- App Permissions
- Configuration Directories
- Default vs. Local Configuration
- Global Context vs. User or App Context
- Runtime Merging of Configurations
- Configuration Testing Commands
- Using btool
- Reloading Configuration Files After Edit
Module 6 - Universal Forwarders
- Forwarders and Indexers
- Benefits of Using Forwarders
- Splunk Universal Forwarder
- Heavy Forwarder
- Configuration Steps
- Configuring the Receiving Port
- Downloading the Universal Forwarder Installer
- Installing Universal Forwarder Manually
- Forwarder Configuration Files
- Defining Target Indexer on the Forwarder
- Testing the Connection
- Automatic Load Balancing
- Caching/Queue Size in outputs.conf
- Indexer Acknowledgement
- Configuring Forwarder Inputs
- Typical Data Input Scenarios
- Data Input Types
- Splunk Index Time Process
- Default Metadata Settings
- Understanding Sourcetypes
Module 8 - Monitor Inputs
- Monitoring Files and Directories
- Monitor Input Syntax
- File Pathname Wildcards
- File and Directory Matching
- Using Whitelist to Include Files
- Using Blacklist to Exclude Files
Module 9 - Splunk Indexes
- Index Replication ñ Concept
Module 10 - Index Maintenance and Optimization
- Viewing Indexing Activity
- Inspecting Buckets ( dbinspect )
- What to Backup
- Backup Recommendation
- Moving an Entire Index: Checklist
- indexes.conf Only Options
- Removing Indexed Data
- Deleting Events
- Cleaning out an Index
- The Fishbucket
- Restoring a Frozen Bucket
Module 11 - Users Roles and Authentications
- Managing Users in Splunk
Module 12 - Manipulating Raw Data
- Indexing Phase Details
Module 13 - Tags and Event Types
- Understanding tags
- Creating tags and using them in a search
- Defining event types and their usefulness
- Creating and using event types in a search
Module 14 - Correlating Events
- What are Indexes
- Default Index: Main
- Other Preconfigured Indexes
- Why Create Your Own Indexes
- Buckets
- Data Flow through an Index
- Managing Indexes with Splunk Web
- What is indexes.conf
- Flow of Buckets
- Overview of Transactions
- Search Transactions
Programme scope, delivery arrangements and suitability are confirmed during enquiry.