Splunk Security Essentials -Master Splunk, SIEM & SOC Skills

In this course, we cover everything from start to finish about using Splunk and the InfoSec app to analyze logs, detect incidents, and respond to cyber threats.

Splunk Security Essentials (SSE) provides out-of-the-box security use cases and actionable security content to begin addressing threats and assessing gaps quickly and efficiently. You can leverage the wide-ranging use case library to eliminate gaps in defensive posture, implement detections, and measure and justify new sources of data based on coverage of threats and risks to the business. Additionally, the deep integration with MITRE ATT&CK and Cyber Kill chain helps you configure Splunk Enterprise Security by pushing attributions to the Incident Review Dashboard, assess the level of coverage to ATT&CK tactics and techniques, and integrate risk-based events and alerting.

• Security content library

  • Browse, bookmark, and deploy over 900 security detections with a few clicks.

  • Find the right security content by filtering via use case, threat, data source, or cybersecurity framework.

  • Stay ahead of threats with content that pulls the latest detections from Splunk Threat Research Team.

• Cybersecurity frameworks

  • Automatically map your data to cybersecurity frameworks such as MITRE ATT&CK and Cyber Kill Chain.

  • Measure your business posture against the frameworks and easily identify gaps to strengthen your defenses.

  • Drill down on MITRE tactics, techniques, and threat groups to understand what detections are tied to different phases of the Kill Chain.

• Data and content introspection

  • Inspect and analyze data and security content already in your environment.

  • Gain a better understanding of your Splunk environment, as well as how your data is or can be Common Information Model (CIM) compliant.

  • Enrich your existing security content with tags and metadata such as threat and data source categories, MITRE ATT&CK notes, and more.

• Security Data Journey

  • Develop a maturity roadmap with security and data recommendations.

  • Track and measure your progress through the Security Data Journey.

  • Implement best practices and detections with the data you’re already collecting.

  • Prioritize ingestion of new data sources to increase coverage and reduce risks.

In this lesson, you will learn the basic cybersecurity concepts and the fundamentals of log collection and analysis, including the purposes of logging (debugging, performance monitoring, security auditing, user behavior analysis, and legal compliance), as well as the core concepts of cybersecurity analytics such as data aggregation, data processing, advanced analytics, and visualization & reporting to detect, predict, and respond to evolving threats.

Benefits of implementing SSE and using security content use cases

Splunk Security Essentials is an extensive security content library that provides detailed guidance on why and how to expand your security use case content in the Splunk platform, Splunk Enterprise Security, Splunk User Behavior Analytics, and Splunk SOAR environments. SSE uses standard search SPL combined with data prerequisites to help you determine if a use case has the right data in place to gain the most value from the content you are interested in. Implementing an SSE use case requires three steps:

1. Validate that you have the right data onboarded and that the fields you want to monitor are properly extracted.

2. Verify that the data format (or a lookup, if appropriate) is accurate so that you are just looking at items of focus.

3. Save or schedule the search.

The components that make SSE so valuable to use case expansion are:

• Use case and categorization. Select from predefined security use cases and go granular through specific threat categorization.

• Data availability. Understand the data you have and its quality or the data you need to add value to your security operations.

• Cyber framework attribution. Enhance your data with MITRE tactics and techniques and Cyber Kill Chain phases.

• Search results and SPL. Understand what is occurring under the hood with line-by-line SPL documentation.

• Visualizations. Analysts use dashboards and heatmaps to assess posture and identify gaps in threat coverage.

• Introspection. Examine your current saved searches, determine detection alignment to SSE content, or create custom detections.

This lesson explains the incident management process and introduces SIEM, including how it works, its use cases, and its advantages.

Understand the data you have and let Splunk Security Essentials guide you to valuable content

You can use SSE to take advantage of the work you have already done in your environment and configure the products that are implemented with the Data Inventory Dashboard.

The Data Inventory dashboard is used to configure the products you have in your environment. Products have a variety of metadata such as source types, event volume, and Common Information Model (CIM) compliance, and are connected with data source categories. The Data Inventory dashboard can show you what content can be turned on using your current data.

In this lesson, we’ll explore Cybersecurity Risk Assessment, learning how to identify, evaluate, and prioritize threats to protect critical assets and strengthen overall security.

Review MITRE ATT&CK tactics and techniques and find detections

As you review common cybersecurity attacks and threats, you might notice that most reports are providing common framework alignments such as the MITRE ATT&CK techniques used in the attack.

This lesson explains the Cyber Kill Chain model, its seven stages of a cyberattack, and how organizations can use it to detect, prevent, and respond to threats proactively.

The SSE security journey

No matter where you are in building out your security operations and processes, Splunk Security Essentials has a way to help you assess, implement and measure your progress. Using the SSE Security Data Journey, you can develop a maturity roadmap with security and data recommendations to secure your business. You can track the progress of your security program and understand milestones and possible challenges at each stage of the journey. You can also implement best practices and security detections with the data you’re already collecting to improve your security posture. Finally, you can use the data onboarding guides to collect and analyze additional host, network, and account activity.

This lesson explains the MITRE ATT&CK framework—a globally recognized model that categorizes adversary tactics, techniques, and procedures into a structured matrix (Enterprise, PRE-ATT&CK, and Mobile), helping organizations analyze attacker behaviors, identify vulnerabilities, strengthen defenses, and proactively defend against advanced cyber threats.

Splunk Security Essentials (SSE) provides out-of-the-box security use cases and actionable security content to begin addressing threats and assessing gaps quickly and efficiently. You can leverage the wide-ranging use case library to eliminate gaps in defensive posture, implement detections, and measure and justify new sources of data based on coverage of threats and risks to the business. Additionally, the deep integration with MITRE ATT&CK and Cyber Kill chain helps you configure Splunk Enterprise Security by pushing attributions to the Incident Review Dashboard, assess the level of coverage to ATT&CK tactics and techniques, and integrate risk-based events and alerting.

This lesson explains the Diamond Model of Intrusion Analysis, a framework with four core components—adversary, infrastructure, capabilities, and victim—that helps security teams not only understand how an attack happened, but also who carried it out, why they did it, and how to anticipate and defend against future threats.

Splunk Security Essentials is an extensive security content library that provides detailed guidance on why and how to expand your security use case content in the Splunk platform, Splunk Enterprise Security, Splunk User Behavior Analytics, and Splunk SOAR environments. SSE uses standard search SPL combined with data prerequisites to help you determine if a use case has the right data in place to gain the most value from the content you are interested in

This lesson covers Cyber Threat Modeling and Risk Assessment, explaining what threat modeling is, why it is necessary, its benefits, and how its effectiveness can be measured using methods like CVSS scoring and penetration testing.

The Security Content page is the main landing page for Splunk Security Essentials. From this page you can easily get a complete list of content or dive deeper into any individual item using a variety of filters.

In this section, we explore Splunk Apps and Splunkbase, showing how to extend Splunk’s capabilities with add-ons like CIM, Sysmon, Machine Learning Toolkit, Enterprise Security, FortiGate, and Tenable, while also learning the step-by-step process of downloading and installing apps from Splunkbase.

Splunk Security Essentials is a free Splunk app that helps you find security procedures that fit your environment, learn how they work, deploy them, and measure your success.

In this lesson, we introduce the Splunk InfoSec App, explain its purpose as a free security-focused application from Splunkbase, outline the prerequisites such as key data sources (firewall, Active Directory, antivirus logs) and supporting add-ons (CIM, Punchcard Visualization, Force Directed Visualization, Lookup File Editor, Sankey Diagram), and show how it helps analyze threats, detect anomalies, and improve security monitoring within Splunk.

Splunk Security Essentials offers default procedures for a variety of security use cases and for every stage of the security journey. The procedures provide a way to start ingesting your data into Splunk Enterprise and monitoring useful metrics within your environment.

In this lesson, we prepare Splunk for the InfoSec App by introducing and installing required add-ons—Splunk CIM for data standardization, Force Directed Visualization for mapping relationships, Lookup File Editor for easy list management, and noting that older visualizations like Punchcard and Sankey have been deprecated in favor of Dashboard Studio.

Splunk Security Essentials uses time series searches to detect spikes, first time seen searches to detect new values, and general Splunk searches

In this lesson, we install the supporting apps needed for the InfoSec App, including Splunk CIM for standardized data, Punchcard and Force Directed Visualization for better analysis, and the Lookup File Editor for easier management of lookup tables

Splunk Security Essentials is an app that can amplify the power of existing security technology investments to strengthen an organization’s security program — no matter their current level of maturity. The app provides an extensive library of pre-built security content that aligns with the MITRE ATT&CK framework and Cyber Kill Chain, making it easy to visualize your current security coverage and find and implement new content that addresses your organization’s needs — without having to create it from scratch. It also offers a prescriptive security maturity framework that helps you determine your current level of maturity and provides recommendations on additional data sources and security content to implement to reach the next level of maturity

In this lesson, we prepare Splunk for the InfoSec App by first setting up and accelerating key CIM data models (Authentication, Intrusion Detection, Network Traffic, Malware, Change, Endpoint, Web), then installing essential add-ons such as the Splunk Add-on for Microsoft Windows and Splunk Add-on for Sysmon, ensuring detailed log collection and standardized data for effective threat detection.

Splunk Security Essentials (SSE) provides out-of-the-box security use cases and actionable security content to begin addressing threats and assessing gaps quickly and efficiently. You can leverage the wide-ranging use case library to eliminate gaps in defensive posture, implement detections, and measure and justify new sources of data based on coverage of threats and risks to the business. Additionally, the deep integration with MITRE ATT&CK and Cyber Kill chain helps you configure Splunk Enterprise Security by pushing attributions to the Incident Review Dashboard, assess the level of coverage to ATT&CK tactics and techniques, and integrate risk-based events and alerting.

In this lesson, we install and configure the Splunk Add-on for Unix and Linux, set it up to monitor meaningful directories like /var/log, enable key scripted metric and event inputs (CPU, disk, network, processes, ports, users), create and assign the proper index, and adjust the inputs.conf file so Splunk can collect and tag Linux system logs and metrics effectively.

• Security content library

  • Browse, bookmark, and deploy over 900 security detections with a few clicks.

  • Find the right security content by filtering via use case, threat, data source, or cybersecurity framework.

  • Stay ahead of threats with content that pulls the latest detections from Splunk Threat Research Team.

• Cybersecurity frameworks

  • Automatically map your data to cybersecurity frameworks such as MITRE ATT&CK and Cyber Kill Chain.

  • Measure your business posture against the frameworks and easily identify gaps to strengthen your defenses.

  • Drill down on MITRE tactics, techniques, and threat groups to understand what detections are tied to different phases of the Kill Chain.

• Data and content introspection

  • Inspect and analyze data and security content already in your environment.

  • Gain a better understanding of your Splunk environment, as well as how your data is or can be Common Information Model (CIM) compliant.

  • Enrich your existing security content with tags and metadata such as threat and data source categories, MITRE ATT&CK notes, and more.

• Security Data Journey

  • Develop a maturity roadmap with security and data recommendations.

  • Track and measure your progress through the Security Data Journey.

  • Implement best practices and detections with the data you’re already collecting.

  • Prioritize ingestion of new data sources to increase coverage and reduce risks.

In this lesson, we explore the Splunk InfoSec App dashboards—starting with Security Posture—and learn how they visualize authentication logs, malware activity, firewall events, network traffic, anomalies, and brute-force attempts, making it easier for SOC analysts to detect, investigate, and respond to security incidents.

Splunk Security Essentials is an extensive security content library that provides detailed guidance on why and how to expand your security use case content in the Splunk platform, Splunk Enterprise Security, Splunk User Behavior Analytics, and Splunk SOAR environments. SSE uses standard search SPL combined with data prerequisites to help you determine if a use case has the right data in place to gain the most value from the content you are interested in.

In this section, we cover abnormal login attempts and brute force attacks—what they are, how they work, their different types (dictionary, credential stuffing, password spraying), and how to detect them through failed logins, suspicious IP behavior, time anomalies, and geolocation mismatches.

In this section, we explore the Splunk Security Essentials app, focusing on how it provides ready-to-use security use cases—like brute force detection—mapped to MITRE ATT&CK tactics and threat groups, with step-by-step queries, implementation guidance, and even SOAR playbook recommendations to help analysts detect, investigate, and respond effectively.

In this section, we dive into phishing attacks and user activity monitoring, focusing on how attackers exploit human behavior with deceptive emails or calls, and how correlation rules in Splunk help us detect anomalies like abnormal logins, unusual access times, or compromised accounts.

In this section, we focus on monitoring user and system activities, learning how to spot abnormal behaviors such as unusual login attempts, data access, or privilege escalation, and applying correlation rules and risk scoring to connect the dots and detect potential insider threats or compromised accounts.

In this lesson, we’ll explore SIEM’s role and advantages. A SIEM (Security Information and Event Management) system acts like the brain of security operations—it collects logs from across the organization, analyzes them, and connects events to spot suspicious activity in real-time. Splunk is one of the leading SIEM platforms, and when paired with security-focused apps like InfoSec App (which visualizes logs and highlights anomalies such as brute force attempts) and Splunk Security Essentials (which provides ready-made use cases mapped to MITRE ATT&CK), it becomes even more powerful. Together, these tools make detection faster, analysis clearer, and response smarter—helping organizations strengthen their defenses and reduce incident response time.

In this lesson, we’re going to introduce Search Processing Language (SPL), which is the backbone of Splunk. SPL is how we interact with data inside Splunk, helping us filter, analyze, and visualize logs quickly and effectively.

In this lecture, we focus on understanding SPL syntax, learning how Splunk’s Search Processing Language is structured and applied to transform raw logs into meaningful insights through commands, functions, and pipelines.

In this lesson, we introduce the basic Splunk search commands used to filter, display, and manage event data.

In this lesson, we continue exploring intermediate search commands that help refine, transform, and correlate log data.

In this lesson, we focus on advanced search commands that support statistical analysis and visualization in Splunk.

In this lesson, we cover expert-level search commands that optimize performance and enable complex investigations.

In this lesson, we explain Splunk functions that extend search commands with calculations, transformations, and data enrichment.

In this lecture, we explore Anomaly and Semantic Analysis Techniques, focusing on three core areas: User Behavior Analytics (UBA), Network Anomaly Detection, and Real-Time Event Detection Rules. UBA helps establish a baseline of what is “normal” user activity and flags deviations such as unusual login times or unexpected data access, making it highly effective against insider threats. Network anomaly detection, on the other hand, builds profiles of typical communication patterns between systems and identifies irregular behaviors—like abnormal traffic spikes or unauthorized external connections—that could indicate attacks such as ransomware or misconfigurations. Finally, real-time event detection rules allow security teams to monitor logs as they arrive and trigger immediate alerts for suspicious actions like repeated failed logins, abnormal file transfers, or unauthorized process executions. Together, these techniques enable organizations not only to detect anomalies early but also to respond swiftly, forming a proactive defense strategy in modern cybersecurity

Splunk Security Essentials (SSE) provides out-of-the-box security use cases and actionable security content to begin addressing threats and assessing gaps quickly and efficiently. You can leverage the wide-ranging use case library to eliminate gaps in defensive posture, implement detections, and measure and justify new sources of data based on coverage of threats and risks to the business. Additionally, the deep integration with MITRE ATT&CK and Cyber Kill chain helps you configure Splunk Enterprise Security by pushing attributions to the Incident Review Dashboard, assess the level of coverage to ATT&CK tactics and techniques, and integrate risk-based events and alerting.