Splunk – SIEM & Log Management

Module 1: Introduction to Splunk

• Splunk overview: architecture, components, and deployment options
• Splunk indexer, search head, forwarder, and deployment server roles
• Installing Splunk Enterprise and Splunk Universal Forwarder
• Splunk Web interface: navigating apps, dashboards, and search

Module 2: Data Ingestion and Indexing

• Data inputs: file monitoring, network inputs, scripted inputs, and HEC
• Index configuration: creating and managing indexes and retention policies
• Source types: defining, configuring, and overriding source types
• Data parsing: timestamps, line breaking, and field extraction at index time

Module 3: Splunk Search Processing Language (SPL)

• SPL fundamentals: search commands, operators, and time range pickers
• Transforming commands: stats, chart, timechart, top, and rare
• Eval and field commands: calculated fields and field manipulation
• Subsearches, lookups, and join commands for data enrichment

Module 4: Reports, Alerts, and Dashboards

• Saving searches as reports: scheduling and sharing reports
• Alerts: threshold, anomaly, and scheduled alert types
• Dashboard Studio: building interactive dashboards with panels
• Tokens and drilldowns: dynamic dashboard interactivity

Module 5: Splunk for Security – SIEM Use Cases

• SIEM fundamentals: log aggregation, correlation, and threat detection
• Security use cases: failed logins, privilege escalation, and lateral movement
• Notable events: Splunk Enterprise Security correlation searches
• Threat intelligence integration: threat feeds and IOC matching

Module 6: Splunk Enterprise Security (ES)

• ES overview: risk-based alerting, threat intelligence, and incident review
• Risk scoring: assigning risk to assets and identities
• Incident review workflow: triaging and investigating notable events
• ES dashboards: security posture, audit, and compliance views

Module 7: Log Management and Compliance

• Log sources: Windows Event Logs, Linux syslog, firewall, and cloud logs
• Data normalisation: CIM (Common Information Model) and field aliases
• Compliance reporting: PCI-DSS, HIPAA, and SOX log retention requirements
• Data archiving: SmartStore and cold/frozen bucket management

Module 8: Capstone Project and Assessment

• SIEM implementation: ingest multi-source logs and build correlation searches
• Security dashboard: threat detection panels with alerts and drilldowns
• Incident investigation: end-to-end alert triage and forensic SPL queries
• Final assessment and course certification

Experience in the Industry Learn from Splunk-certified architects and SOC analysts who have implemented Splunk SIEM for financial institutions, healthcare organisations, and government agencies managing security operations and compliance log management.

Backgrounds at the Top Our Splunk trainers hold Splunk Enterprise Certified Architect or Splunk Enterprise Security Certified Admin credentials and have designed Splunk deployments ingesting terabytes of daily log data.

Clear & Effective Teaching Splunk architecture, SPL search language, data ingestion, dashboards, alerts, Enterprise Security, SIEM use cases, CIM, and compliance log management are explained with real SOC and log management examples.

Hands-On Learning Focus Students ingest real log data, write SPL queries, build security dashboards, configure alerts, investigate simulated incidents, and deploy Splunk Enterprise Security through structured hands-on labs.

Up-to-Date Knowledge Trainers keep content current with the latest Splunk Cloud and Enterprise releases, Splunk SOAR integration, and evolving SIEM and security operations centre best practices.