SPLK-ADVSOARIMP - Advanced SOAR Implementation

SPLK-ADVSOARIMP - Advanced SOAR Implementation

SPLK-ADVSOARIMP - Advanced SOAR Implementation

Overview

Duration: 3.0 days

This 13.5 hour course is intended for experienced SOAR consultants who will be responsible for complex SOAR solution development, and will prepare the attendee to integrate SOAR with Splunk as well as develop playbooks requiring custom coding and REST API usage.
Potential attendees have received a passing grade in all prerequisite courses, and must ensure they can devote all of their attention to the class, as the course work is very challenging. Students will develop a custom solution with SOAR, Splunk and custom Python code. The labs provide requirements for the solution; the student must plan and execute the development. This will require thoughtful focus, experimentation and problem-solving skills.

Objectives

Please refer to course overview.

Content

Module 1 – Implementing Splunk and SOAR

Review of SOAR UI and concepts
Describe interactions between Splunk and SOAR
Identify key concepts and data flows
Pre-requisites for integration

Module 2 – Configuring External Splunk Search

Describe the benefits of externalizing search to Splunk
Configure the SOAR instance for externalization
Configure the Splunk instance for externalization
Use the Splunk app for SOAR Reporting

Module 3 – Sending Splunk Events to SOAR

Configure the SOAR Add-on for Splunk
Map CIM fields to CEF
Send Enterprise Security notables to SOAR
Automatically trigger SOAR playbooks for Splunk notables

Module 4 – Accessing Splunk from SOAR

Install and configure the SOAR App for Splunk
Ingest Splunk events into SOAR
Use Splunk search from playbooks
Update Splunk notable events

Module 5 – Custom Coding in Playbooks

- SOAR coding best practices
- Writing, using and managing custom functions
- Using the SOAR API in custom code
- Store and retrieve persistent data

Module 6 – Using SOAR REST

Use Django queries to search for data in SOAR
Use REST to access SOAR data
Use the HTTP app to execute REST from playbooks

Audience

Prerequisites

Attendees for this class must ensure that they meet all course pre-requisites. This is a challenging, advanced class that draws on technical knowledge from many areas in Splunk and SOAR, and the demanding labs and course schedule leave little time to learn the basics.

Classes:

Experience with Python programming
Adminstering Splunk SOAR
Developing Splunk SOAR Playbooks
Enterprise Splunk Data Administration
Enterprise Splunk System Administration
Either Using or Administering Splunk Enterprise Security

Certification

Lịch khai giảng

Tên khóa học

Thời gian

Lịch dự kiến

Hình thức

Học phí

ĐĂNG KÝ

Form đăng ký

Bằng cách nhấn nút "ĐĂNG KÝ", tôi hoàn toàn đồng ý với Chính sách quyền riêng tư

Các khóa đào tạo Splunk khác

SPLK-PUSRFS - Power User Fast Start

This Power User "Fast Start" course covers over 60 commands, functions, and knowledge objects to provide users with actionable information about searching best practices and knowledge management. Students will learn how to effectively utilize time in searches, work with different time zones, use transforming commands and eval functions to calculate statistics, compare field values with eval functions and eval expressions, manipulate output, normalize fields and field values, correlate and filter data from multiple sources, and create, manage, and share knowledge objects.

SPLK-COREUSR - Splunk Core User

A Splunk Core Certified User is able to search, use fields, create alerts, use look-ups, and create basic statistical reports and dashboards in either the Splunk Enterprise or Splunk Cloud platforms. This optional entry-level certification demonstrates an individual's basic ability to navigate and use Splunk software.

SPLK-CMAP - Creating Maps

This three-hour course is designed for power users who want to create maps in Splunk. It focuses on the data and components required to create cluster and choropleth maps. It also shows how to format, customize and make maps interactive.

SPLK-ENTCADM8.2 - Splunk 8.2 Cluster Administration

This 3-virtual day certification & training course is for an experienced Splunk Enterprise administrator who is new to Splunk Clusters. The course provides the fundamental knowledge of deploying and managing Splunk Enterprise in a clustered environment. It covers installation, configuration, management, and monitoring of Splunk clusters. While Splunk Clusters are supported in Windows environments, the class lab environment is running Linux instances only.

SPLK-DPLYPRACLAB - Splunk Enterprise Deployment Practical Lab

This 24-hour practical lab exercise certification & training course is designed to take you through the tasks of a complete mock deployment. Each participant is given access to a specified number of Linux servers and a set of requirements. Participants then perform a mock deployment according to requirements which adhere to Splunk Deployment Methodology and best-practices.

SPLK-ANDATSC - Splunk 8.0 for Analytics and Data Science

This 13.5 hour certification & training course is for users who want to attain operational intelligence level 4, (business insights) and covers implementing analytics and data science projects using Splunk's statistics, machine learning, built-in and custom visualization capabilities.

SPLK-UITSVCINTEL4.9 - Using Splunk IT Service Intelligence 4.11

This one-day course is designed for analyst users who want to use Splunk IT Service Intelligence to manage, analyze, and optimize their IT services. Those who will implement Splunk IT Service Intelligence, please enroll in Implementing Splunk IT Service Intelligence instead.

SPLK-IITSVCINTEL4.9 - Implementing Splunk IT Service Intelligence 4.11

This 18 hour course is designed for administrator users who will implement Splunk IT Service Intelligence for analysts to use. The first day includes the day of content from Using Splunk IT Service Intelligence.

SPLK-DEVRSTAPI8.1 - Developing with Splunk's REST API 8.2

This nine hour course teaches you how to use the Splunk REST API to accomplish tasks interacting with Splunk servers. In this course, you will use curl and Python to send requests to Splunk REST endpoints and will learn how to parse and use the results. The course will show you how to create a variety of objects in Splunk, how to change properties, work with and apply security to Splunk objects, run different types of searches and parse its results, ingest data using the HTTP Event Collector and manipulate collections and KV Stores.

SPLK-BLAPPS8.2 - Building Apps with Splunk 8.2

This two-day certification & training course focuses on Splunk Enterprise app development. It's designed for advanced users, administrators, and developers who want to create apps for Splunk Enterprise and Splunk Cloud. Major topics include planning apps, building data generators, adding data, custom search commands and REST endpoints, using the KV Store, app vetting using AppInspect and app packaging.

SPLK-ARCENTDEP8.0.1 - Architecting Splunk 8.0.1 Enterprise Deployments

This nine-hour certification & training course focuses on large enterprise deployments. Students will learn steps and best practices for planning, data collection and sizing for a distributed deployment. Workshop-style labs challenge students to make design decisions about an example enterprise deployment.

SPLK-ADVDVIZ8.1 - Advanced Dashboards and Visualizations with Splunk 8.1

This one-day certification & training course is designed for advanced users who want to create SplunkJS dashboards and Splunk Custom Visualizations. It focuses on creating dashboards, adding inputs, using event handlers and creating Splunk Custom Visualizations using JavaScript and XML.

SPLK-CLADM8.2 - Splunk 8.2 Cloud Administration

This 4-day (18 hour) hands-on certification & training course prepares administrators to manage users and get data in Splunk Cloud. Topics include data inputs and forwarder configuration, data management, user accounts, and basic monitoring and problem isolation. The course provides administrators with the skills, knowledge and best practices for data management and system configuration for data collection and ingestion in a Splunk Cloud environment to maintain a productive Splunk SaaS deployment.

SPLK-TSHOOTENT8.2 - Troubleshooting Splunk Enterprise 8.2

This 2-virtual day certification & training course is designed for Splunk administrators. It covers topics and techniques for troubleshooting a standard Splunk distributed deployment using the tools available on Splunk Enterprise. This lab-oriented class is designed to help you gain troubleshooting experience before attending more advanced courses. You will debug a distributed Splunk Enterprise environment using the live system. This course does not cover the issues surrounding Splunk Cloud, Splunk Clusters, or Splunk premium apps.

SPLK-SEAA8.2 - Splunk Enterprise 8.2 Data Administration

This 3 virtual day certification & training course is designed for administrators who are responsible for getting data into Splunk Indexers. The course provides the fundamental knowledge of Splunk forwarders and methods to get remote data into Splunk indexers. It covers installation, configuration, management, monitoring, and troubleshooting of Splunk forwarders and Splunk Deployment Server components.

SPLK-SESA8.2 - Splunk Enterprise 8.2 System Administration

This 2 virtual day certification & training course is designed for system administrators who are responsible for managing the Splunk Enterprise environment. The course provides the fundamental knowledge of Splunk license manager, indexers and search heads. It covers configuration, management, and monitoring core Splunk Enterprise components.

SPLK-WOMET8.1 - Working with Metrics in Splunk 8.1

This nine hour course provides Splunk users in-depth information about metrics, ingesting and searching metrics data, and how to use the Analytics Workspace to analyze and create visualizations.

SPLK-SSS8.1 - Implementing Splunk SmartStore 8.1

This 1-virtual day certification & training course is designed for the experienced Splunk system administrators. This hands-on class is designed to provide the essential knowledge for deploying and managing Splunk SmartStore. It covers SmartStore deployment options, cache manager configurations, monitoring, and troubleshooting of SmartStore implementation.

SPLK-TRANSPCLOUD8.2 - Transitioning to Splunk Cloud 8.2

This 2-virtual day certification & training course highlights key differences between Splunk Enterprise deployed on-premise and Splunk Enterprise Cloud to allow Splunk Administrators to transition to Splunk Cloud. The course provides the skills and knowledge for Splunk Cloud administrators to collect and ingest data as well as manage their cloud environment and maintain a productive Splunk SaaS deployment.

SPLK-CVAL - Comparing Values

This three-hour course is for power users who want to learn how to compare field values using eval functions and eval expressions. Topics will focus on using the comparison and conditional functions of the eval command, and using eval expressions with the fieldformat and where commands.

SPLK-COAN - Correlation Analysis

This three-hour course is for power users who want to learn how to calculate co-occurrence between fields and analyze data from multiple datasets. Topics will focus on the transaction, append, appendcols, union, and join commands.

SPLK-RMOD - Result Modification

This three-hour course is for power users who want to use commands to manipulate output and normalize data. Topics will focus on specific commands for manipulating fields and field values, modifying result sets, and managing missing data. Additionally, students will learn how to use specific eval command functions to normalize fields and field values across multiple data sources.

SPLK-MVF - Multivalue Fields

This three-hour course is for power users who want to become experts on searching and manipulating multivalue data. Topics will focus on using multivalue eval functions and multivalue commands to create, evaluate, and analyze multivalue data.

SPLK-SDFS - Splunk Developer Fast Start

This "Fast Start" course covers courses that will help you prepare for the Splunk Developer Certification

SPLK-SSEAFS - Splunk Enterprise Administration Fast Start

This "Fast Start" course covers courses that will help you prepare for the Splunk Enterprise Admin Certification

SPLK-CCD - Creating Classic Dashboards

This six-hour course (with an additional one hour break for lunch) is designed for Splunk power users who want to create advanced, interactive dashboards using the classic, simple XML framework. The course focuses on tokens, user inputs, dynamic drilldowns, and event handlers. It combines a strong technical focus with the opportunity to practice in a realistic lab environment

SPLK-KMSOC - Kubernetes Monitoring with Splunk Observability Cloud

This virtual course targeted to SREs and DevOps enables you to monitor and troubleshoot your Kubernetes clusters with Splunk Observability Cloud. Through discussions and hands-on activities, learn to explore and use the Kubernetes Navigator, built-in dashboards, and AutoDetect to monitor the health of your cluster. Create custom dashboards and detectors to monitor and troubleshoot common Kubernetes trouble conditions. This course assumes basic knowledge of Kubernetes and familiarity with navigating Splunk IM. This lab-oriented class is designed to help you learn best practices and tips to use Splunk Observability Cloud to monitor and troubleshoot Kubernetes clusters. All hands-on labs are performed in the Observability Cloud UI.

SPLK-SPRO - Statistical Processing

This three-hour course is for power users who want to identify and use transforming commands and eval functions to calculate statistics on their data. Topics will cover data series types, primary transforming commands, mathematical and statistical eval functions, using eval as a function, and the rename and sort commands.

SPLK-WTIME - Working with Time

This three-hour course is for power users who want to become experts at using time in searches. Topics will focus on searching and formatting time in addition to using time commands and working with time zones.

SPLK-LLS - Leveraging Lookups and Subsearches

This three-hour course is designed for power users who want to learn how to use lookups and subsearches to enrich their results. Topics will focus on lookup commands and explore how to use subsearches to correlate and filter data from multiple sources.

SPLK-SEFS - Splunk Search Expert Fast Start

This "Fast Start" course covers over 60 commands and functions and prepares students to be search experts. Students will learn how to effectively utilize time in searches, work with different time zones, use transforming commands and eval functions to calculate statistics, compare field values with eval functions and eval expressions, manipulate the output, normalize fields and field values, use lookups and sub searches to enrich results, and correlate and filter data from multiple sources. This class will take place over three 6-hour days (plus a 1-hour break each day)

SPLK-INTRODYD - Introduction to Dashboards

This three-hour course is designed for power users who want to learn best practices for building dashboards in the Dashboard Studio. It focuses on dashboard creation, including prototyping, the dashboard definition, layouts types, adding visualizations, and dynamic coloring.

SPLK-DYD - Dynamic Dashboards

This three-hour module is designed for power users who want to learn best practices for building dashboards in the Dashboard Studio. It focuses on creating inputs, chain searches, event annotations, and improving dashboard performance.

SPLK-CKNOB - Creating Knowledge Objects

This three-hour course is for knowledge managers who want to learn how to create knowledge objects for their search environment using the Splunk web interface. Topics will cover types of knowledge objects, the search-time operation sequence, and the processes for creating event types, workflow actions, tags, aliases, search macros, and calculated fields.

SPLK-CFE - Creating Field Extractions

This three-hour course is for knowledge managers who want to learn about field extraction and the Field Extractor (FX) utility. Topics will cover when certain fields are extracted and how to use the FX to create regex and delimited field extractions.

SPLK-EDLOK - Enriching Data with Lookups

This three-hour course is for knowledge managers who want to use lookups to enrich their search environment. Topics will introduce lookup types and cover how to upload and define lookups, create automatic lookups, and use advanced lookup options. Additionally, students will learn how to verify lookup contents in search and review lookup best practices.

SPLK-DMOD - Data Models

This three-hour course is for knowledge managers who want to learn how to create and accelerate data models. Topics will cover datasets, designing data models, using the Pivot editor, and accelerating data models.

SPLK-SOPZ - Search Optimization

This three-hour course is for power users who want to improve search performance. Topics will cover how search modes affect performance, how to create an efficient basic search, how to accelerate reports and data models, and how to use the tstats command to quickly query data.

SPLK-DPP - Developing Phantom 4.10 Playbooks

This 9 hour course prepares IT and security practitioners to plan, design, create and debug playbooks for Phantom.

SPLK-ADMPHAN4.10 - Administering Phantom 4.10

This 13.5 hour course is intended for experienced Phantom consultants who will be responsible for complex Phantom solution development, and will prepare the attendee to integrate Phantom with Splunk as well as develop playbooks requiring custom coding and REST API usage. Potential attendees have received a passing grade in all prerequisite courses, and should ensure they can devote all of their attention to the class, as the course work is very challenging. Students will develop a custom solution with Phantom, Splunk and custom Python code. The labs provide requirements for the solution; the student must plan and execute the development. This will require thoughtful focus, experimentation and problem-solving skills.

SPLK-ADVPHANIMP4.10 - Advanced Phantom Implementation 4.10

This 13.5 hour course is intended for experienced Phantom consultants who will be responsible for complex Phantom solution development, and will prepare the attendee to integrate Phantom with Splunk as well as develop playbooks requiring custom coding and REST API usage. Potential attendees have received a passing grade in all prerequisite courses, and should ensure they can devote all of their attention to the class, as the course work is very challenging. Students will develop a custom solution with Phantom, Splunk and custom Python code. The labs provide requirements for the solution; the student must plan and execute the development. This will require thoughtful focus, experimentation and problem-solving skills.

SPLK-ADMSOAR - Administering Splunk SOAR

This 3.5 hour course prepares IT professionals to configure and manage SOAR.

SPLK-DEVSOARPB - Developing SOAR Playbooks

This 9 hour introductory course prepares IT and security practitioners to plan, design, create and debug basic playbooks for SOAR. Students will learn fundamentals of SOAR playbook capabilities, creation and testing. This course is a pre-requisite for the Advanced SOAR Implementation course.

SPLK-IISS - Investigating Incidents with Splunk SOAR

This 3 hour course prepares security practitioners to use SOAR to respond to security incidents, investigate vulnerabilities, and take action to mitigate and prevent security problems.

SPLK-CTAPM - Configuring Tracing and Profiling for Splunk APM

This single subject course targeted to DevOps enables you to learn configuration techniques to send traces to Splunk APM. Through in-person discussions and hands-on activities, learn to deploy the Splunk OpenTelemetry Collector on a Linux host. Use the OpenTelemetry Collector to configure processor components to modify trace metadata. Use auto-instrumentation to send in traces without altering your code. Enable AlwaysOn profiling to monitor code performance. This course assumes familiarity with navigating Splunk APM which is covered in the course Using Splunk Application Performance Monitoring.

SPLK-INSTRUAPPAPM - Instrumenting Applications for Splunk APM

This 1-day virtual course targeted to developers and DevOps enables you to instrument your applications to send traces to Splunk APM. Through in-person discussions and hands-on activities, learn to deploy the Splunk OpenTelemtry Connector on a Linux host. Use auto-instrumentation to send in traces without altering your code. Use manual instrumentation to create spans and add metadata to spans. This course assumes familiarity with navigating Splunk APM which is covered in the course Using Splunk Application Performance Monitoring. This lab-orientated class is designed to help you learn the fundamentals of instrumenting your code to send in traces. All hands-on labs are in Python and Java.

SPLK-MONINFRAF - Splunk Infrastructure Monitoring Fundamentals

This course serves as the foundation for all other Splunk Infrastructure Monitoring courses. It is targeted towards DevOps/SRE/Observability teams, Senior On-call Engineers, Onboarding and Monitoring Strategists and Developers. This 1-virtual day course provides a fundamental understanding of Splunk Infrastructure Monitoring concepts such as the Splunk IM data model and different types of metadata. See how you can search for metrics, find more information about a metric, visualize and alert on metrics. Learn to use appropriate rollups, interpret chart data based on chart resolution, rollups and analytic functions. All concepts are taught using lectures and scenario-based hands-on activities.

SPLK-VIZALRTINFRAMON - Visualizing and Alerting in Splunk Infrastructure Monitoring

This course assumes that you have completed the course Splunk Infrastructure Monitoring Fundamentals. It is targeted towards DevOps/SRE/Observability teams, Senior On-call Engineers, Onboarding and Monitoring Strategists and Developers. This 1-virtual day course describes ways to enhance your dashboards and alerts to help with troubleshooting. Find insights using analytics in charts and detectors. Create detectors for common use cases. All concepts are taught using lectures and scenario-based hands-on activities.

SPLK-APPPRFMMON - Using Splunk Application Performance Monitoring

This 1-virtual day course targeted to developers and DevOps enables you to use Splunk APM to analyze traces, troubleshoot and monitor your microservices-based applications. Through in-person discussions and hands-on activities, deep dive into uses of distributed tracing, navigating the Splunk APM app to analyze traces, visualize and alert on APM metrics. All concepts and taught through discussions and hands-on activities.

SPLK-APPMETSPLKIM - Ingesting Application Metrics in Splunk IM

This 1-day virtual course, targeted towards developers and DevOps, focuses on creating custom metrics to monitor your applications/services with Splunk IM. Learn to instrument applications/services to send in custom metrics that characterize the application of service. Define relevant metadata for your metrics to let you find, filter and aggregate the metrics that you want to chart or alert on. Create charts and custom dashboards to visualize these custom metrics. Create detectors to monitor the metrics to alert when there are any issues with the application or service. Learn the concepts and apply the knowledge through discussions and hands-on activities.

SPLK-TERRAPROSPLKIM - Using the Splunk IM Terraform Provider

This virtual 2-day course targeted towards DevOps, Observability and SRE teams is a follow-up to the course "Automation Using the REST and SignalFlow APIs". Learn to use the Splunk Terraform provider to manage Splunk IM resources for visualization, alerting and teams. Create and manage detectors and muting rules. Learn to create and modify teams including team notification policies.

SPLK-AUTORESTSFLO - Automation Using the REST and SignalFlow API

Splunk IM exposes a comprehensive API that allows you to automate any action that can be done using the User Interface. This 2-day virtual course provides the foundation for you to use the API to automate bulk actions such as the creation of charts, dashboards, and alerts. See how to programmatically perform computations that can be used in charts and detectors or streamed in real-time. Use the API to manage Splunk IMteams Learn the concepts and apply the knowledge through discussions and hands-on activities.

SPLK-LOGOBS - Using the Splunk Log Observer

This course is designed for developers responsible for debugging their own applications, and for SREs responsible for troubleshooting performance issues. The Splunk Log Observer is built primarily for DevOps teams working on applications built on modern tech stacks (containerized micro-services). However, the course it can be taken by anyone who wants to view recent log data in a no-code environment. This 1-virtual-day course describes how to use the tool to work with log data using the no-code user interface. You will learn to create, save, and share search filters; and to investigate the shape of your log data. You will analyze logs with aggregation functions and group by rules. And you will create rules to manipulate incoming data, as well as to generate synthetic metrics from log data. All concepts are taught using lectures and scenario-based hands-on activities.

SPLK-MONKBSPLKIM - Kubernetes Monitoring Using Splunk IM

This 1-virtual day course is targeted to Site Reliability Engineers, DevOps Engineers, and Application Developers who deploy on and/or who manage Kubernetes clusters. This course teaches the skills you need to monitor and troubleshoot your Kubernetes infrastructure with Splunk. We teach how to track and alert on the status of your installation using built-in tools focused on Kubernetes. You will learn to introspect clusters from multiple perspectives and identify potential trouble-indicators. Through in-person discussions and hands-on activities learn multiple ways you can view and automate the monitoring of your clusters and running jobs.

SPLK-ADMONCALL - Splunk On-Call Administration

This course is targeted towards Splunk On-call admins responsible for setting up incident response with Splunk On-Call. This 1-virtual day course describes the tasks required to set up on-call teams, including defining schedules, on-call rotations and shifts. Learn to set-up and configure alerts and integrations. Create post-incident review reports, track response metrics and customize reports. Use advanced features such as the Rules engine for advanced customization and configure webhook integrations. All concepts are taught using lectures and scenario-based hands-on activities.

SPLK-ADMENTSEC6.6 - Administering Splunk Enterprise Security 7.0

This 13.5 hour course prepares architects and systems administrators to install and configure Splunk Enterprise Security (ES). It covers ES event processing and normalization, deployment requirements, technology add-ons, dashboard dependencies, data models, managing risk, and customizing threat intelligence.

SPLK-ENTSEC6.6 - Using Splunk Enterprise Security 7.0

This 13.5-hour course prepares security practitioners to use Splunk Enterprise Security (ES). Students identify and track incidents, analyze security risks, use predictive analytics, and discover threats.

Cơ hội nhận ưu đãi học phí lên tới 60%

Trainocate - Đối tác đào tạo ủy quyền của hơn 30 hãng công nghệ hàng đầu thế giới

Ngày

00

Giờ

0

Phút

0

Giây

0

Đăng ký tư vấn
cùng đội ngũ chuyên gia Trainocate!!

Bản quyền thuộc về Trainocate Việt Nam

back to top

Hotline HN
Hotline HCM
Messenger