شکار تهدیدات با اسپلانک (Threat Hunting With Splunk)

Module 1: Threat Detection Fundementals

• Introduction to Cyber Threats
• Threat Detection Approaches
• Use Case Definition
• Threat Detection Process
• Threat Detection Requirements

Module 2: Introduction To Splunk

• What is Splunk
• Splunk and Machine Data
• Splunk Use Cases
• Splunk Products and Apps
• Splunk Deployment (Single Instance and Distributed)
• Getting Data In Splunk
• Indexing Data With Splunk

Module 3: Search Processing Language (SPL)

• Types of SPL commands
• Splunk search optimization
• Filter commands
• Report commands
• Group commands
• Field commands
• Regular expression
• Lookup commands
• Correlation commands

Module 4: Basic Security Usecases

• Brute Force Detection
• Network Scan Detection
• HTTP Maliciois Activiy Detection

Module 5: Advanced Security Use Cases

• Lookup with Splunk
• Regular Expression
• Detecting DNS Based Threats
• Malware Beaconing Detection
• Malicious SSL Connections Detection
• Detecting Malicious Windows Tools
• Detecting Windows Lateral Movement
• Situational Awareness 



Module 6: Miscellaneous Topics

• Introduction to Threat Intelligence and Splunk
• Threat Intelligence and Splunk
• Alerts Investigation Scenarios