Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Subscribe
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
A Hands-On Guide to Splunk Enterprise Security
Rating: 3.5 out of 5(98 ratings)
590 students

A Hands-On Guide to Splunk Enterprise Security

Practice makes Perfect, Master Splunk by Practice!
Created bySai Acuity Institute of Learning Pvt Ltd Enabling Learning Through Insight!
Last updated 9/2020
English
English [Auto],

What you'll learn

  • You will get an introduction to Splunk's user interface and will be conversant with the UI post this session.
  • We cover Navigating splunk web: splunk home, splunk bar, splunk web and getting date into splunk
  • You will learn how to specify data inputs, where splunk stores data and getting tutorial data into splunk
  • You will start using splunk search, search actions and modes, search results tools, events, what are fields, extracted fields, find and select fields etc
  • Start using Splunk's basic transforming commands and create reports, dashboards and alerts.
  • You will start using Splunk Enterprise Security
  • You can setup Splunk on your system, save and share reports and start creating alerts
  • You will understand what vulnerabilities are and will learn how to mitigate them

Course content

8 sections • 13 lectures • 10h 0m total length

  • Course Introduction2:28

    Explore splunk enterprise security hands-on, learn the ui, navigate splunk web, and ingest data. Use search language, fields, and transforming commands to create reports, dashboards, and alerts.

  • Splunk Introduction25:47

    This lecture introduces Splunk Enterprise Security, explaining how Splunk collects, indexes, searches, and visualizes machine data from various sources, using apps, dashboards, and alerts to monitor security incidents.

  • Introduction to Splunk's user interface1:20:07

    Explore Splunk enterprise security's user interface, including data inputs and indexes. Learn to search, manage jobs, alerts, and dashboard panels across data sources.

Requirements

  • You should have basic knowledge on SIEM tools

Description

You will understand Splunk's user interface -UI. You will be able to navigate UI features on your own: Navigating Splunk web: Splunk home, Splunk bar, Splunk web, getting date into Splunk, how to specify data inputs, where Splunk stores data, getting tutorial data into Splunk, using Splunk search, search actions, and modes, search results tools, events, what are fields, extracted fields, find and select fields, run more targeted searches, use the search language, learn with search assistant.

You can start using the Splunk's basic transforming commands, can create reports and dashboards, you will know how to save and share reports and also can create alerts after completing these sections.


How Splunk Works: Stages in the Data Pipeline

Splunk is a distributed system that ingests, processes and indexes log data. Splunk processes data in three stages:

  1. Data Input – Splunk ingests the raw data stream from the source, breaks it into 64K blocks, and adds metadata keys, including hostname, source, character encoding, and the index the data should be stored in.

  2. Data Storage – Splunk parses log data, by breaking it into lines, identifying timestamps, creating individual events and annotating them with metadata keys. It then transforms event data using transformation rules defined by the operator. Finally, Splunk writes the parsed events to disk, pointing to them from an index file which enables fast search across huge data volumes.

  3. Data Search – at this stage Splunk enables users to query, view and use the event data. Based on the user’s reporting needs, it creates objects like reports, dashboards and alerts.

Hands-on practical videos on Enterprise Splunk Security: ES1, ES2, ES3 & ES4 will help you master Splunk!

Who this course is for:

  • Beginners and Intermediate students interested in learning SIEM hands-on tools

Report abuse