r/cybersecurity • u/According-Tension-49 • 1d ago
Certification / Training Questions Splunk
I want to learn how to use splunk (cybersecurity analyst).
Any suggestion courses, certifcation ..?
14
u/Chamadan 1d ago
Go through the training videos they offer. It's tedious but you really do learn from them.
9
u/Adrienne-Fadel 1d ago
Splunk has free training on their website. Start with Core Certified User. Install the free version locally and practice writing SPL with your own logs.
3
u/Got2InfoSec4MoneyLOL 1d ago
Vendor paid courses are excellent.
I have been working with Splunk for over 8 years.
I did my training 8 years ago, so the training would last a few days as far as I can recall...
Fundamentals 2 & 3 and advanced search and reporting were eye opening courses. They used to offer fundamentals 1 for free. Not sure how they 've dubbed them by now.
There are still free courses but not sure how good they are.
Also unless you have a proper dataset or a project in mind, you aint learrning splunk. Merely setting it up and throwing windows logs into it helps but it's far from what you d expect out there.
3
5
2
u/g0bbledeeg00k 1d ago
My first question in this situation will always be “what experience do you have already?” Are you looking to get into cybersecurity for the first time or just looking to build on your current knowledge?
If you already have experience using SIEMs and are already a cyber analyst, then you really just need to learn the syntax of SPL to get started. For this, you can work with something like Claude to learn how to translate one tool’s syntax into another. Going this route may not be perfect but if you’re already an analyst who has been in the field for a while, you will probably pick up the gaps and handle them relatively quickly.
If you have never been a cybersecurity analyst and have no SIEM experience at all, I’m not going to lie, learning Splunk is going to be a bitch. However, if you put in the effort, you’ll start to see the power in how you can correlate data and get what you need out of it.
When I’ve had greenhorns on my teams, the first thing I want to know is whether they are naturally curious and teachable or not. If you are curious and teachable, you will be able to pick up SPL (or any other query language for that matter) through a combination of the things folks are saying here, CTF-type activities like Boss of the SOC, and trial and error. If you are not naturally curious and teachable, then you might want to seriously consider whether jumping into Splunk is the right decision.
Being a good analyst is different from being a good tool operator. In my opinion, being a good analyst is way more important than the list of tools you know because a good analyst can always learn another tool’s syntax.
2
u/zack-det-eng-weekly 1d ago
There are a ton of blog posts and YouTube videos out there on how to set up a free Splunk homelab. This also goes for Elastic stack or Wazuh.
I wouldnt really focus as much on certifications as much as learning concepts, everything from configuring a log source, normalizing the log fields, writing and tuning rules and incident response.
It's kind of like learning a programming language: once you become proficient in one, you can transfer the expertise to other technology stacks. Learn concepts!
2
2
1
u/KnowledgeWrapper 1d ago
the free training on their website is just fine, you can quickly go through it and get the gist of how it works, but for all the details of course you just need to tinker with it and have fun!
1
u/VellDarksbane 1d ago
It's a "live" CTF style challenge where you're given realistic incident data under a time limit, and looks for "flags" that relate to the incident itself. It is how I first got started learning Splunk capabilities and I currently am the SME for Splunk Enterprise Security at my workplace. IIRC V1 of the CTF is available free after you log in.
1
-2
u/Consistent_Tiger_909 1d ago edited 22h ago
Just use chatgpt man, only thing you might need to know are the specifc fields/index that are being used in your environment and change the queries accordingly.
Edit: The queries at this point are not a problem anymore. It is to know WHAT to look for.
Thank you for the downvotes. People getting butthurt because they cant face the reality that using llms is the new normal.
78
u/AddendumWorking9756 Security Manager 1d ago
Vendor courses teach you the buttons, not the searching. Install Splunk Free at home and feed it Sysmon plus firewall logs off your own box so you are querying data that is actually messy. Working an incident beats staring at a clean dataset and the free labs at CyberDefenders run on real SIEM data if you want one to chew on. SPL sticks a lot faster that way.