Splunk Risk-Based Alerting Hands-On Workshop

This workshop is led by Splunk Public Sector Consulting Solutions Engineers (CSEs) with advanced cybersecurity knowledge and is designed to give participants hands-on experience with RBA. The lessons learned in this workshop will provide participants with the ability to begin deploying RBA with Enterprise Security. Initial goals include optimizing functions in the SOC such as detection engineering, triage, and investigations which ultimately free up cycles to focus on proactive activities such as adversary simulation, threat intelligence, SOAR, and threat hunting.

The workshop agenda is approximately 4 hours and includes:

• Risk Analysis Data Model
• Correlation Rules
• Assets and Identity
• MITRE Annotations
• Risk Factor Rule – Exercise
• Risk Rules – Exercises
• Risk Notables – Exercise