A Hands-On Guide to Splunk Enterprise Security
Practice makes Perfect, Master Splunk by Practice!
Ratings 3.49 / 5.00
What You Will Learn!
- You will get an introduction to Splunk's user interface and will be conversant with the UI post this session.
- We cover Navigating splunk web: splunk home, splunk bar, splunk web and getting date into splunk
- You will learn how to specify data inputs, where splunk stores data and getting tutorial data into splunk
- You will start using splunk search, search actions and modes, search results tools, events, what are fields, extracted fields, find and select fields etc
- Start using Splunk's basic transforming commands and create reports, dashboards and alerts.
- You will start using Splunk Enterprise Security
- You can setup Splunk on your system, save and share reports and start creating alerts
- You will understand what vulnerabilities are and will learn how to mitigate them
Description
You will understand Splunk's user interface -UI. You will be able to navigate UI features on your own: Navigating Splunk web: Splunk home, Splunk bar, Splunk web, getting date into Splunk, how to specify data inputs, where Splunk stores data, getting tutorial data into Splunk, using Splunk search, search actions, and modes, search results tools, events, what are fields, extracted fields, find and select fields, run more targeted searches, use the search language, learn with search assistant.
You can start using the Splunk's basic transforming commands, can create reports and dashboards, you will know how to save and share reports and also can create alerts after completing these sections.
How Splunk Works: Stages in the Data Pipeline
Splunk is a distributed system that ingests, processes and indexes log data. Splunk processes data in three stages:
Data Input – Splunk ingests the raw data stream from the source, breaks it into 64K blocks, and adds metadata keys, including hostname, source, character encoding, and the index the data should be stored in.
Data Storage – Splunk parses log data, by breaking it into lines, identifying timestamps, creating individual events and annotating them with metadata keys. It then transforms event data using transformation rules defined by the operator. Finally, Splunk writes the parsed events to disk, pointing to them from an index file which enables fast search across huge data volumes.
Data Search – at this stage Splunk enables users to query, view and use the event data. Based on the user’s reporting needs, it creates objects like reports, dashboards and alerts.
Hands-on practical videos on Enterprise Splunk Security: ES1, ES2, ES3 & ES4 will help you master Splunk!
Who Should Attend!
- Beginners and Intermediate students interested in learning SIEM hands-on tools
