Splunk Phantom Virtual Workshop

Join us for a Splunk Phantom virtual workshop. This workshop is designed to familiarize participants with how to respond to incidents, manage cases and artifacts, as well as automate your incident response and standard operating procedures.

Users will have the opportunity to walk through real-world scenarios and see first-hand how Phantom can be used from the creation of notable events to enriching alerts by automatically gathering data, all the way to managing and resolving incidents.

This workshop leverages the popular Boss of the SOC (BOTS) dataset and is laid out in an interactive format. Users will leave with a better understanding of how Phantom can be used to decrease the amount of time needed to triage and respond to alerts and they will also build their own basic investigative playbook. The workshop agenda includes:

• A brief overview of Phantom
• Incident investigation
• Workbooks and case management
• Playbook development for an automated response
• Automation and orchestration best practices