Splunk Certified Cybersecurity Defense Analyst study plan

Diagram the data pipeline from forwarder to indexer to search head, labeling where parsing, indexing, and search-time field extraction occur

Map each core Splunk SOC component (indexes, sourcetypes, CIM data models, lookups, macros) to the analyst task it supports

Explain how the Common Information Model normalizes multi-vendor data and identify which data models a typical auth and endpoint log source populates

Write 10 SPL searches that use stats, eval, where, and time modifiers to answer basic SOC triage questions about authentication events

Distinguish notable-event-driven alerting from risk-based alerting and articulate when each is appropriate

Decompose risk into its four components (risk object, risk score, risk message, risk modifiers) and construct a risk-generating search for a failed-login scenario

Configure risk scoring so that repeated low-severity events aggregate into a single high-priority finding

Compare risk object types and justify choosing user, system, or other entity types for three given scenarios

Build a risk framework that maps detection coverage to MITRE ATT&CK techniques and identifies where risk rules are missing

Design risk notable policies that adjust urgency and suppress noise without suppressing signal

Tune false positives by adding risk modifiers and contextual lookups (asset criticality, identity role) to existing rules

Explain how risk-based alerting reduces alert fatigue by correlating independent weak signals into a single investigation

Formulate hypothesis-driven hunt questions from a threat-intel report and translate each into SPL

Select appropriate data sources and time windows for a given hypothesis instead of searching everything

Apply the hunt cycle (hypothesis, data, analysis, finding, feedback to detection) to one full iteration

Document hunt results in a repeatable template that captures hypothesis, query, evidence, and outcome

Hunt for living-off-the-land binary abuse and suspicious process ancestry using endpoint telemetry

Hunt for lateral movement and credential access by correlating authentication, service creation, and remote execution events

Use statistical baselining and outlier detection to surface anomalous entities rather than relying on static thresholds

Identify coverage gaps revealed by hunts and feed them back into the risk framework built in week 3

Convert successful hunt queries into production detections with appropriate thresholds, throttling, and risk scoring

Analyze malware and endpoint detection telemetry to reconstruct a plausible infection chain

Trace an intrusion across identity, endpoint, and network data sources to build a unified timeline

Distinguish true positive, benign true positive, and false positive outcomes and record the reasoning for each

Execute a structured investigation from alert triage through scoping, containment recommendation, and closure

Scope a suspected compromise by identifying all affected entities and the blast radius from available telemetry

Apply the analyst workflow to a multi-stage scenario combining phishing, execution, persistence, and exfiltration

Draft an incident summary that separates confirmed evidence from inference

Re-audit every domain against the exam blueprint and list weak areas with a remediation action for each

Re-run all saved searches and risk rules to confirm they still produce expected results

Complete two timed practice sets and analyze every miss by root cause rather than by topic label

Rehearse explaining RBA mechanics, hunt methodology, and investigation workflow aloud without notes