Splunk for Security Analytics and Monitoring

Learn how to plan the deployment and management of a Splunk ecosystem.

Introduction

• Splunk explained
• What you should know

1. The Splunk Ecosystem

• SIEM and SOAR overview
• Splunk overview
• Splunk components
• Splunk data ingestion

2. Deploying Splunk

• Splunk deployment planning
• Installing Splunk on Linux
• Installing Splunk on Windows
• Splunk users and roles
• Using the Splunk web GUI
• Using the Splunk CLI

3. Splunk and the Cloud

• Deploying the AWS Splunk AMI
• Deploying Splunk Cloud

4. Splunk Data Ingestion

• Forwarding Linux logs to Splunk
• Forwarding Windows log events to Splunk
• Monitoring Windows files
• Monitoring Windows printers
• Configuring Snort IDS alerts for Splunk
• Configuring an HTTP Event Collector (HEC)
• Forwarding Microsoft AD events to Splunk Cloud

5. Splunk Insights

• Splunk searching overview
• Performing Splunk queries
• Working with Splunk dashboards and reports
• Managing Splunk alerts

Conclusion

• What's next?