Splunk Certified Cybersecurity Defense Analyst case studies
Splunk Certified Cybersecurity Defense Analyst · Put your knowledge to work in context.
The Splunk Certified Cybersecurity Defense Analyst credential is an intermediate-level certification for security practitioners who use Splunk Enterprise and Splunk Enterprise Security in day-to-day security operations. Splunk positions it for SOC analysts, cybersecurity professionals, and career builders who want to demonstrate knowledge critical to detecting, analyzing, and combating cyber threats. The Splunk Certified Cybersecurity Defense Analyst case studies are 5 cases and about 4,370 words.
1Zero Results on the Dashboard, 4,200 Events in the Raw Index
Your Splunk ES deployment ingests 240 GB/day against a 300 GB/day license. Windows Security events from 1,800 servers arrive through 40 universal forwarders, and the Endpoint and Authentication data models are accelerated with a 7-day summary range.
765 words, about 4 min2One Rule Owns 78% of the Notable Queue
You run Splunk ES with risk-based alerting. The risk window is 24 hours and the aggregation threshold that creates a risk notable is 100.
903 words, about 5 min3Are We Being Kerberoasted? A Four-Hour Hunt
A CISO asks whether the estate is being kerberoasted. You have 45 days of Windows Security events from 6 domain controllers totalling about 90 million events per day, plus Sysmon from 400 servers.
859 words, about 4 min44,100 TXT Queries From a Finance Workstation
A weekly hunt over DNS telemetry (Zeek plus Sysmon, about 900 million events per week) surfaces host 10.4.22.51, a finance analyst's Windows workstation, issuing 4,100 TXT queries in six hours to 32-48 character pseudo-random subdomains of sync-telemetry[.]net. Mean inter-arrival is 5.2 seconds with a coefficient of variation of 0.03.
930 words, about 5 min5Fourteen Correlation Searches Were Skipped Overnight
The overnight shift received 12 notables instead of the usual 60-70. Splunk ES job diagnostics show 14 of 210 enabled correlation searches were skipped between 02:00 and 05:00 with a concurrency-limit message.
913 words, about 5 min