گواهینامه‌ی دوره

برای دریافت گواهینامه‌ی این دوره، ده روز پس از جلسه‌ی پایانی، آزمونی برگزار خواهد شد که با قبولی در این آزمون، امکان صدور گواهینامه‌ی دوره برای شما را خواهیم داشت. حضور در آزمون پایانی و دریافت گواهینامه‌ی دوره برای شرکت‌کنندگان اختیاری است.

هزینه‌ی شرکت در آزمون پایانی: ۳۰ هزارتومان
هزینه‌ی چاپ و صدور گواهینامه‌ی دوره: ۵۰ هزارتومان

این دوره به چه افرادی توصیه می‌شود؟

• کارشناسان مراکز SOC
• مهندسین امنیت شبکه و زیرساخت
• تحلیل‌گران امنیت سایبری
• مشاورین امنیت سایبری
• کارشناسان Digital Forensic
• کارشناسان شکار تهدیدات سایبری

برای حضور در این دوره چه دانش‌هایی باید داشته باشم؟

• آشنایی با مفاهیم حملات سایبری
• آشنایی با مفاهیم و تعاریف تحلیل وقایع و لاگ
• آشنایی با Splunk Enterprise

سرفصل‌های دوره

Chapter 1: Getting Started with ES

1.1 Describe the features and capabilities of Splunk Enterprise Security (ES)

1.2 Explain how ES helps security practitioners prevent, detect, and respond to threats

1.3 Describe correlation searches, data models, and notable events

1.4 Describe user roles in ES

Chapter 2: Security Monitoring and Incident Investigation

2.1 Use the Security Posture dashboard to monitor ES status

2.2 Use the Incident Review dashboard to investigate notable events

2.3 Take ownership of an incident and move it through the investigation workflow

2.4 Create notable events

2.5 Suppress notable events

Chapter 3: Risk-Based Alerting

3.1 Give an overview of Risk-Based Alerting

3.2 View Risk Notables and risk information on the Incident Review dashboard

3.3 Explain risk scores and how to change an object’s risk score

3.4 Review the Risk Analysis dashboard

3.5 Describe annotations

3.6 Describe the process for retrieving LDAP data for an asset or identity lookup

Chapter 4: Investigations

4.1 Use investigations to manage incident response activity

4.2 Use the Investigation Workbench to manage, visualize and coordinate incident investigations

4.3 Add various items to investigations (notes, action history, collaborators, events, assets, identities, files and URLs)

4.4 Use investigation timelines, lists and summaries to document and review breach analysis and mitigation efforts

Chapter 5: Using Security Domain Dashboards

5.1 Use ES to inspect events containing information relevant to active or past incident investigation

5.2 Identify security domains in ES

5.3 Use ES security domain dashboards

5.4 Launch security domain dashboards from Incident Review and from action menus in search results

Chapter 6: Web Intelligence

6.1 Use the web intelligence dashboards to analyze your network environment

6.2 Filter and highlight events

Chapter 7: User Intelligence

7.1 Evaluate the level of insider threat with the user activity and access anomaly dashboards

7.2 Understand asset and identity concepts

7.3 Use the Asset and Identity Investigators to analyze events

7.4 Use the session center for identity resolution

Chapter 8: Threat Intelligence

8.1 Give an overview of the Threat Intelligence framework and how threat intel is configured in ES

8.2 Use the Threat Activity dashboard to see which threat sources are interacting with your environment

8.3 Use the Threat Artifacts dashboard to examine the status of threat intelligence information in your environment

Chapter 9: Protocol Intelligence

9.1 Explain how network data is input into Splunk events

9.2 Describe stream events

9.3 Give an overview of the Protocol Intelligence dashboards and how they can be used to analyze network data