• This course is designed for anyone interested in getting start with Splunk to perform Network Forensic Analysis. This can include SOC analysts, Network Engineers, System Administrators, Data Analysts.

• Basic knowledge of Network logs

Course Outline:

Splunk Architecture

• Overview of Splunk and its key features
• Splunk data model and architecture
• Setting up Splunk as Docker Container
• Hands-on: Installing Splunk

Data Ingestion

• Importing data into Splunk
• Parsing data using Sourcetypes
• Using Add-ons to parse data
• Hands-on: Ingesting sample data into Splunk

Searching and Analysis

• Working with Splunk Search Processing Language (SPL)
• Understanding search assistant modes
• Search commands for filtering, sorting and transforming data
• Using fields, tags and event types to enhance search results
• Work with a use case to find attack vectors
• Hands-on: Use case

Data Visualization

• Using Splunk’s Data Visualizations and Dashboards
• Building Dashboard inputs using Time Range Picker
• Adding Text Box, Drop Down to Dashboard inputs
• Hands-on: Creating Dashboard with panels

Understanding Splunk’s Distributed Architecture

• Understanding Splunk’s Distributed Architecture Components
• Role of Indexers in data storage and replication
• Using Universal Forwarders, Distributors, and Deployment Server
• Demo: Building a Splunk Distributed Deployment

Training material provided: Yes (Digital format)

Hands-on Lab: Students should install Docker Desktop.