Splunk Detection and Incident Response

What Splunk Detection and Incident Response teaches: write tstats-accelerated detections over CIM data models, hunt across identity, endpoint, network, and cloud, and run an incident end to end from the search bar.

How Splunk stores and retrieves data, search-time versus index-time, the Common Information Model, where NE's evidence lives, and your first detection-grade searches against the corpus.

The accelerated-search backbone: how CIM data models normalize NE's sources, how tstats reads the acceleration summary to search millions of events in moments, and how to point it at the Authentication, Endpoint...

The compute layer: eventstats and streamstats for baselining, bin for time shape, transaction for session reconstruction, subsearch and join for correlation, lookup for enrichment and allowlisting, and rex for...

The lifecycle and discipline that turns a search into a production detection: hypothesis to correlation search, calibrating thresholds from data, false-positive reduction, suppression and scheduling, testing, and...

Detecting the identity attacks that dominate cloud intrusions, on the Authentication model: password spray, MFA gaps, risky sign-ins, impossible travel, adversary-in-the-middle token replay, and OAuth persistence...

Detecting the endpoint-compromise chain on the Endpoint data model and Sysmon: process ancestry, encoded execution, LOLBins, credential theft, persistence, lateral movement, and host-based C2, engineered against NE's...

Detecting an intrusion in the traffic that leaves the estate: beacon cadence and shape in proxy logs, exfiltration by volume, DNS as a covert channel, threat-intel and CIDR matching at the egress, and the perimeter...

The proactive search for the intrusion no rule caught: hypothesis-driven hunting, tstats over accelerated data models for whole-estate speed, and the cloud as a hunting surface, working a real AWS account compromise...

The incident-response entry point in Splunk: triage a queue to the one lead that matters, validate it against independent telemetry, scope the blast radius across identity, endpoint, network, and cloud, reconstruct...

Full multi-source incident reconstruction in Splunk: work backward to initial access, reconstruct the identity, endpoint, network, and cloud stages each in depth, correlate them into one chain, and assemble a...

The Splunk-driven incident response workflow after the investigation: preserve search-derived evidence, derive the remediation picture, contain and evict the attacker across identity, endpoint, network, and cloud...

The capstone: applying the whole course method to a fresh edge-to-identity intrusion, from a single alert on an internet-facing host through triage, reconstruction of the entry and the pivot inward, correlation and a...

SPL by investigation area, each search with the fields that carry the decision and what the result does not establish.

Ordered procedures for the situations that recur: validating a lead, scoping an identity, building a timeline, tuning a noisy detection and proving an eviction.

Building a Splunk instance that runs this course's searches, with the license decision that determines which modules you can actually practice in it.

Six worked investigations against the course corpus, each ending in a written finding with its confidence stated and its gaps named.

Seven playbooks keyed to what actually fires, each with a pre-flight, a sequence, escalation tiers and the false positives that live in that domain.

Where to practice SPL and use it at work: the drills, the corpus, your own instance, the detection library, and the reference pages worth keeping open.

Splunk documentation, the Common Information Model, MITRE ATT&CK, Splunk Security Content, NIST SP 800-61 Rev 3, and the threat-intelligence and methodology sources used throughout the Splunk Detection and Incident...

Splunk Detection and Incident Response end-of-course exam: a simulation-based assessment testing your ability to triage, investigate, and respond to a Splunk-detected intrusion you have not seen before, using the...