Opleiding: Administering Splunk Enterprise Security (ASES)

This 13.5-hour instructor-led course enables SOC Engineers to use Splunk’s Enterprise Security SIEM for detection engineering, incident response, automation, asset and identity configuration, and t...

This 13.5-hour instructor-led course enables SOC Engineers to use Splunk’s Enterprise Security SIEM for detection engineering, incident response, automation, asset and identity configuration, and threat intelligence management. Other topics include ES event processing and normalization, managing risk, data models, deployment requirements, technology add-ons, and dashboard dependencies.

This course may be delivered over two or three days, with 13.5 total hours of content.

This course is for ES Administrators and Engineers.

Module 1 - Detection Engineering


- Give an overview of ES detections and finding types
- Create Event-based detections using the Detection Editor
- Review the configuration of Finding-based detections
- Highlight the details of Detection Studio
Module 2 - Customizing the Analyst Queue and Findings


- Divide the Analyst Queue into Team-based Queues
- Create and use Views
- Customize the Analyst Queue
- Modify Urgency
- Create new Status values
- Add fields to Finding attributes
- Suppress F...