EVENT

EMEA Virtual Security Workshop Series

Please note these sessions are run in Europe time zones – GMT & CET.

Welcome to Splunk Security Ninja Workshop Series. These 4 hour, hands-on security workshops are brought to you by the Splunk team via Zoom. Learn, connect & interact with Splunk subject matter experts, colleagues and industry peers, and have some fun on the way! Virtual hands-on workshops are a convenient, interactive way to build your Splunk security skills and knowledge – from the comfort of your work or home office.

If you register for one of our sessions, please add [email protected] as a safe sender in your email to ensure you receive our confirmation email and joining details.

We welcome you to join us for one, a few or all of our workshops in this series.

Hungry for more Splunk hands-on workshops? Check out our Splunk4Rookies & Splunk4Rookies Observability programme.

What you'll need:
Just you, your laptop, and a browser that can access external websites. You will also need a splunk.com account to access the workshop environment (create an account here). We run these workshops on Zoom, if you don’t have the Zoom client on your device you will be able to access via a web browser.

Splunk Security Workshop Series

Enterprise Security Hands-on

Enterprise Security Hands-On is a modular, hands-on designed to familiarize participants with how to investigate incidents using Splunk Enterprise and Splunk Enterprise Security 7.0. This workshop provides users an opportunity to walk through multiple scenarios and see first-hand how Enterprise Security can be used from the creation of a notable event to investigate all the way to the raw event that identifies the adversaries action. The workshop leverages the popular Boss of the SOC (BOTS) dataset and is laid out in an interactive format. Users will leave with a better understanding of how Splunk and Enterprise Security can be used to generate notable events and investigate them as they occur in the enterprise.

Building Correlation Searches for Enterprise Security

Building Correlation Searches with Splunk Enterprise Security is a modular, hands-on workshop designed to familiarize participants with how to leverage Splunk to develop their own correlation searches. This workshop provides users a way to gain familiarity with building correlation searches in Splunk, as well as introducing data models and the tstats command that can provide a user a method to further optimize their correlation searches. The workshop leverages the popular Boss of the SOC (BOTS) dataset with hands-on exercises that build on one another. Users will come away with a better understanding of how to build their own correlation searches in Splunk as well as how to customize their associated notable events to provide more immediate insights to their analysts.

AWS Security Hands-on

This workshop is designed to extend your knowledge into the AWS suite of solutions beyond EC2 and S3. During the workshop, hands-on investigations leveraging CloudTrail and CloudWatch data, as well as VPC Flow data, are provided. Data sets created by AWS security solutions, like GuardDuty and Security Hub, will be introduced as well. The workshop concludes with detections from ESCU and SSE to highlight the integration of AWS data sources into Enterprise Security. The workshop leverages the Boss of the SOC (BOTS) dataset with hands-on exercises throughout. Users will come away with a better understanding of the logging available to them from AWS and which events are important to collect to gain visibility into adversary actions in the environment.

Security Operations Suite Hands-on

The Security Products Hands-On is a modular, hands-on workshop designed to familiarize participants with how to investigate incidents using Splunk Enterprise, Enterprise Security, UBA and Phantom. This workshop provides users an opportunity to walk through multiple scenarios and see first- hand how Splunk Security Products can be used to take notable events and investigate, hunt and orchestrate actions based on what is uncovered. The workshop leverages the popular Boss of the SOC (BOTS) dataset and is laid out in an interactive format. Users will leave with a better understanding of how Splunk, Enterprise Security, UBA and Phantom can be used within security operations to process notable events and investigate as they occur in the enterprise.

Security Orchestration, Automation, and Response Hands-on

The SOAR Hands-On workshop (previously the Phantom Hands-On) is designed to familiarize participants with how to respond to incidents, manage cases and artifacts, as well as automate your incident response and standard operating procedures. This workshop provides users an opportunity to walk through a real-world scenario and see first-hand how Splunk SOAR can be used from the creation of a notable event to enriching alerts by automatically gathering data, all the way to managing and resolving the incident.

Splunking the Endpoint Hands-On Workshop

Splunking the Endpoint is a modular, hands-on workshop designed to familiarize participants with different endpoint technologies and how to leverage Splunk to gain greater insight into the activities occurring on the endpoint. This workshop provides users a way to gain familiarity with various endpoint logging tools, including Microsoft Event Logs, Sysmon, PowerShell, osquery, CB and Cisco NVM, as well as introduces them to Splunk Security Essentials and ES Content Updates. A utility called Window Event Code Analyzer is also covered which is designed to assist users in determining which Windows events to log! The workshop leverages the popular Boss of the SOC (BOTS) dataset with hands-on exercises for each technology. Users will come away with a better understanding of the logging at the endpoint available to them and which events are important to collect to gain visibility into adversary actions on the endpoint.

Splunk Security Essentials Hands-on

Security Essentials Hands-on is a modular, hands-on designed to familiarize participants with how to setup and use Security Essentials in multiple security scenarios. The workshop leverages the popular Boss of the SOC (BOTS) dataset and is laid out in an interactive format. Users will leave with a better understanding of how Splunk and Security Essentials can be used to find security content, develop a content strategy, report on security progress and coverage as you would in a real environment.

Risk-Based Alerting Hands-On Workshop

The Risk-Based Alerting (RBA) hands-on workshop is designed to guide Detection Engineers or other content creators with the RBA process used in Splunk Enterprise Security. Our journey will begin with a review of ES fundamentals as a foundation for RBA then proceeds through Risk Factors, Risk Rule creation, and Risk Notable creation. The workshop leverages the popular Boss of the SOC (BOTS) dataset with hands-on exercises that build on one another and expose the participants to detecting a complex APT attack. The participants will depart with a clear path for getting started with RBA in their environment.