This course prepares you for the Splunk Certified Cybersecurity Defense Analyst certification, which validates the ability to detect, analyse and counter cyber threats with Splunk Enterprise and Splunk Enterprise Security. It is designed for SOC analysts and runs three or four days depending on your prior Splunk skills. The programme follows the official blueprint, from the threat landscape to threat hunting, with plenty of investigation exercises. You leave with a repeatable triage routine you can apply in your own SOC.
Place the analyst's role within a SOC and the main industry frameworks
Recognise attack types, TTPs and threat intelligence tiers
Assess data sources and apply SIEM best practices
Run an investigation in Enterprise Security, from signal to decision
Use risk-based alerting and correlation searches
Write efficient SPL searches and carry out threat hunts
Program
The cyber landscape, frameworks and standards (10%)
SOC organisation and roles
Controls, standards and frameworks
Information assurance and risk management
Threat and attack types, motivations and tactics (20%)
Common attacks and vectors
Threat intelligence
Annotations in Enterprise Security
Tactics, techniques and procedures
Defences, data sources and SIEM best practices (20%)
Defence systems and data sources
Working with Enterprise Security
Assessing sourcetypes
Investigation, event handling, correlation and risk (20%)
Monitoring and investigation stages
Performance metrics (MTTR, dwell time)
Risk-based alerting
SPL and efficient searching (20%)
SPL commands for security analysis
Search-building best practices
Threat hunting and remediation (10%)
Hunting techniques
Adaptive response actions and SOAR playbooks
Prerequisites
No prerequisite exams
Splunk recommends Power User-level knowledge of Splunk Enterprise
Security basics: networks, systems, common attacks
Prior SOC experience is an advantage
Target audience
Tier 1 and tier 2 SOC analysts
Detection and response engineers
Aspiring threat hunters
Splunk administrators moving into security
The exam
This intermediate-level exam has 66 multiple-choice questions to answer in 75 minutes, including three minutes for the exam agreement. It is delivered by Pearson VUE. There is no prerequisite exam, although Splunk advises Power User-level skills. The listed fee is USD 130 per attempt. The official blueprint spreads the questions across six topics, four of which weigh 20% each.
Preparation tips
Take part in a Boss of the SOC (BOTS) exercise to practise investigation.
Master the vocabulary: event dispositions, notables, risk.
Review the SPL commands used most in security analysis.
Frequently asked questions (FAQ)
Do I need Power User certification first?
No exam is required. Splunk does recommend Power User-level skills, though; if you are not there yet, choose the four-day format.
Do I need to know Splunk Enterprise Security?
Yes. Several topics cover its use: annotations, notables and risk-based alerting. We work with it in labs during the course.
Is it suitable for a cybersecurity beginner?
It is intermediate level. A complete beginner will benefit from learning security and Splunk basics first.
How long is the exam?
75 minutes in total for 66 questions, including three minutes for the exam agreement. That leaves roughly one minute per question, so time management matters, and we train it with timed practice sets.
What does it bring to my SOC?
A shared investigation method, better use of Enterprise Security and more efficient searches, which helps cut alert handling time.
Securevalley training — online and in-person sessions. Contact us for pricing and registration terms.
Securevalley is not a training partner of Splunk. Splunk, Splunk Enterprise Security and Splunk Certified Cybersecurity Defense Analyst are trademarks of Splunk LLC.