Splunk Certified Cybersecurity Defense Analyst key terms

Security Information and Event Management: a platform that centrally collects logs and security telemetry, normalizes and correlates it, and surfaces alerts so analysts can detect and respond to threats across an environment.

The team and facility responsible for continuously monitoring, detecting, investigating, and responding to security events, usually organized into tiers with defined escalation paths and documented procedures.

A security analytics application built on the Splunk platform that adds correlation searches, notable events, incident review workflows, asset and identity context, threat intelligence, and risk-based alerting on top of core search.

A Splunk convention that maps vendor-specific fields to shared normalized field names and tags, so searches and correlation rules work consistently across many different data sources and add-ons.

Splunk's query language, in which a base search is followed by a chain of piped commands such as eval, stats, where, and lookup to filter, transform, and enrich results.

A default field that identifies the format and origin type of a data feed, such as a specific firewall or web server log format, and drives how Splunk parses events and extracts timestamps.

A Splunk feature that precomputes summarized data model results on disk, allowing fast searches over large time ranges without scanning every raw event each time.

A reference file, such as a CSV or KV Store collection, that a search can join against events to add context, translate values, or supply allow-lists and watchlists.

A lightweight Splunk agent installed on endpoints or servers that monitors files and forwards raw data to an indexer with minimal processing and low resource consumption.

The average elapsed time between when a threat first appears in the environment and when defenders become aware of it; a common metric for measuring detection effectiveness.

An approach that assigns numeric risk to entities for observed behaviors and raises an alert only when accumulated risk crosses a threshold, reducing alert volume while preserving context from many contributing detections.

The Splunk index, conventionally named risk, where risk entries are written by searches; it stores the object, score, risk message, and related fields used to aggregate entity risk.

The entity to which a risk entry is attributed, typically a user, a system or host, or another identifiable subject whose behavior is being scored.

A numeric value attached to a risk entry that, when summed across all entries for a given object over a time window, represents how suspicious that entity currently appears.

A named category describing the kind of behavior or source that produced a risk entry, helping analysts understand what class of activity is driving an entity's accumulated score.

Additional risk applied automatically to an entity based on contextual attributes such as asset criticality, identity importance, or a threat intelligence match, increasing the likelihood of escalation.

The notable event generated when an entity's aggregated risk exceeds the configured threshold; it summarizes the highest-scoring risk entries and links back to the contributing evidence.

The alert action added to a correlation search that writes a risk entry, including object, score, and message, to the risk index instead of or in addition to creating a notable event.

The configured cumulative risk score an entity must exceed within a defined time window before a risk notable is created; it controls alert sensitivity and volume.

An individual risk entry that feeds into an entity's total score and is listed inside a risk notable so the analyst can see each behavior that pushed the entity over the threshold.

A proactive, analyst-led search through telemetry for hidden adversary activity that existing detections did not flag, rather than waiting for an alert to fire.

A structured hunt that begins with a testable statement about likely adversary behavior in the environment and then uses searches to confirm or disprove it, producing reusable findings either way.

A publicly maintained knowledge base of adversary tactics and techniques observed in real intrusions, widely used to organize detections, map coverage gaps, and prioritize hunt hypotheses.

Tactics, Techniques, and Procedures: the goals adversaries pursue, the general methods they use to achieve them, and the specific implementation details observed in a given campaign.

A forensic artifact such as a file hash, IP address, domain, or registry key known to be associated with malicious activity; useful for matching but easily changed by attackers.

A behavioral pattern signaling that an intrusion is underway or intended, such as unusual privilege escalation or lateral movement, which focuses on adversary intent rather than static artifacts.

Establishing what normal activity looks like for a host, user, or network segment over a period so that deviations can be identified and investigated during hunts or detection tuning.

Taking an artifact or attribute found in one event, such as a process name or IP address, and searching other data sources for it to expand understanding of the activity.

A Splunk command that searches indexed fields and accelerated data model summaries rather than raw events, returning results very quickly over long time ranges during hunts and investigations.

Running a newly developed detection or hunt hypothesis against retained historical data to find activity that occurred before the logic existed, sometimes called back-in-time hunting.

A saved SPL search in Splunk Enterprise Security that runs on a schedule or in real time, applies logic and thresholds to events, and produces notable events, risk entries, or response actions.

A record created by a correlation search that captures the triggering results along with severity, urgency, priority, status, owner, and comments so analysts can work it as an investigation.

The Splunk Enterprise Security dashboard where notable events are reviewed, filtered, assigned to analysts, annotated, linked to related events, and moved through statuses to closure.

The rapid first-pass assessment of an alert to decide whether it is a true positive, how severe and widespread it is, and whether it should be escalated, closed, or investigated further.

An automated action attached to a correlation search or alert, such as creating a notable, adding risk, sending email, or running a script, that executes when the search returns results.

A suppression setting that prevents the same search, or the same combination of field values, from generating repeated notable events within a defined time window.

Splunk Enterprise Security lookups that maintain records of known systems and users, which are correlated onto events to add ownership, criticality, and business context that can adjust severity and risk.

A Splunk Enterprise Security capability that ingests external intelligence feeds into intel collections, normalizes them into a threat intel data model, and matches them against events and entities.

Analytics that build behavioral models for users and systems and flag statistically unusual activity, helping surface insider threats and compromised accounts that signature detections would miss.