You will learn the complete ES architecture, data onboarding workflows, correlation search creation, Notable Event management, Risk-Based Alerting (RBA), and integration with threat intelligence feeds and SOAR platforms. Every topic includes lab exercises using enterprise-grade configurations.
This course is designed for security engineers, SIEM administrators, and SOC leads who are responsible for maintaining and optimizing Splunk ES deployments. Upon completion, you will have the hands-on capability to architect, administer, and continuously improve an ES-based security operations platform.
What is Splunk Enterprise Security? : Overview of ES as a premium security app, its use cases, and how it differs from standard Splunk.
ES Architecture Components : Understanding ES search head, accelerated data models, KV Store, and correlation search scheduler.
ES Installation & Initial Configuration : Step-by-step installation of Splunk ES on a search head and initial setup wizard walkthrough.
ES App Structure & Navigation : Navigating the Security Posture dashboard, Incident Review, and Glass Tables.
Course
Splunk Enterprise Security (ES) Administration
No LMS account? Contact CCN office to get onboarded.
Ratings & Reviews
Average -
4.7★
Raghavendra Pillai
1 month ago
Best ES Admin course available!
I've been a Splunk admin for two years but this course filled in so many gaps. The RBA and SOAR integration modules were exactly what our SOC needed to reduce alert fatigue.
Meghna Chakraborty
2 months ago
Completely changed how we run our SOC
After this course, I rebuilt our ES correlation search library from scratch with proper MITRE mapping. The platform engineer at our company noticed the improvement immediately.
Suresh Venkataraman
3 weeks ago
Very detailed and hands-on
The data onboarding and threat intelligence integration sections were extremely thorough. I especially appreciated the real-world troubleshooting scenarios in the labs.
Pallavi Deshmukh
2 weeks ago
Got hired as SIEM Engineer!
I transitioned from a generic IT role to a dedicated SIEM Engineer position after completing this course. The ES administration skills are in high demand and this course covers everything.
Frequently Asked Questions
Completion of the Splunk Core Certified User and Power User courses is strongly recommended. Familiarity with basic cybersecurity concepts and log analysis will also be helpful.
Yes, the course covers both on-premises and Splunk Cloud deployments, including hybrid architectures. Module 16 specifically addresses cloud deployment considerations.
Absolutely. Module 6 is entirely dedicated to RBA, covering risk rule creation, risk object management, threshold searches, and the Risk Analysis dashboard with lab exercises.
Yes, Module 8 covers Splunk SOAR integration including adaptive response action configuration, playbook triggers, and case management workflows.
Module 17 covers mapping ES to PCI DSS, HIPAA, ISO 27001, and NIST, as well as building automated compliance reports and maintaining audit trails.
Get Free Counselling
Fill out the form below and our counsellor will get in touch with you shortly.
🔒 Your information is safe with us. No spam, ever.
