Building Correlation Searches With Splunk, Hands On Workshop

*12:00pm AEST

This is a modular, hands-on workshop designed to show participants how to leverage Splunk to develop their own correlation searches. Users will gain familiarity with building correlation searches in Splunk, as well as introducing data models and the tstats command that can provide a user a method to further optimise their correlation searches. The workshop leverages the popular Boss of the SOC (BOTS) dataset with hands-on exercises that build on one another. Users will come away with a better understanding of how to build their own correlation searches in Splunk as well as how to customise their associated notable events to provide more immediate insights to their analysts.

Prerequisites: Splunk Fundamentals 1 (highly recommended), Enterprise Security hands on workshop or some ES experience is also be recommended.