SIEM and SOC Fundamentals: The Platform, the App, and the CIM Contract
Two products in one exam
Splunk Enterprise Security (ES) is an app on top of the Splunk platform. The platform indexes data, runs searches, and handles indexer/search-head architecture; ES adds correlation searches, the asset and identity framework, risk analysis, notable events, and threat intelligence. Many wrong answers come from mixing the layers - indexer clustering and search-time field extraction are platform topics, while notables, risk, and data-model acceleration are ES topics.
The SOC workflow
A tiered SOC triages notables, escalates, and tunes detections; metrics such as MTTD and MTTR measure the loop. Know the difference between a saved search, a correlation search, and a notable event: the correlation search is the detection logic, and each qualifying result becomes a notable event that lands in Incident Review.
CIM is the contract
Cross-vendor detection requires the Common Information Model, delivered as accelerated data models (Authentication, Endpoint, Network_Traffic, Web, Change). Field aliases and tags map raw vendor fields onto CIM names. Trap: a well-named sourcetype is not CIM-compliant - verify tags, aliases, and acceleration. Trap: tstats reads only accelerated data-model fields, so unmapped raw fields must be searched with plain SPL.
Rule of thumb: if a detection mentions a vendor field name, ask whether the normalized equivalent exists.
Worked example: sourcetype=WinEventLog:Security EventCode=4624 becomes portable as | tstats count from datamodel=Authentication where Authentication.action=success by Authentication.user, Authentication.src - the second form also covers VPN and Linux sources.