The Administering Splunk Enterprise Security course equips IT professionals with essential skills for effective security management. Participants will learn to explain the functions of a SIEM, navigate Splunk's Enterprise Security (ES), and configure roles and permissions. The curriculum covers customizing the Analyst Queue, conducting thorough investigations, and managing Asset & Identity effectively. Key topics include data normalization, detection engineering, and Risk-Based Alerting (RBA), empowering users to enhance threat detection capabilities. Additionally, students will understand threat intelligence and learn best practices for post-deployment configuration. By the course’s end, attendees will confidently apply these concepts to bolster their organization’s security posture.
