GuidePoint Security, deepwatch, & Splunk Event
Registration for this Event is Closed
B-Sides Tampa - Investigating with Splunk Workshop - Morning Session
Friday, March 26, 2021 | 11:00 a.m. - 1:00 p.m. ET | Online
|
|
|
The Investigating with Splunk Workshop is a new offering that provides savvy security analysts the ability to walk through a scenario from the BOTS (Boss of the SOC) data set to better understand how Splunk Enterprise can be used as an investigatory tool. At the heart of threat hunting and incident response is the ability to investigate the data sets you have.
If I don’t know how to investigate, how can I hunt or respond?
This workshop develops threat pictures for a scenario as well as maps events to the Lockheed Martin Kill Chain so that users gain a greater understanding of how an investigation progresses using Splunk. These concepts could then be applied to phases within the Incident Response lifecycle as well as during Threat Hunting.
Agenda Requirements:
The first two hours provide a hands-on demo of finding and identifying threats using Splunk Enterprise. Attendees are expected to supply their own computer and Internet connection. They will be given access to a hosted Splunk environment in the cloud. Accounts will already be created and distributed for use. During the workshop, attendees will generate searches along with the instructor, following a story to find details of an attack in the mock data.
A setup with multiple monitors is suggested to follow along with the slides while using a browser window to join in the experience. We will be using Zoom and your favorite browser, but we suggest the latest Chrome.
Please let us know if you have any questions before the event. Extra helpers will be available during the workshop to assist so please don't hesitate to ask questions.
Registration for this Event is Closed
