SPLK-5001: Splunk Certified Cybersecurity Defense AnalystDemo

Splunk CIM uses src_ip to store the IP address of the source host—the system initiating the connection. In lateral movement, that source system is the host from which the attacker is moving.

Operational intelligence provides context about a specific threat actor or campaign, including the actor’s intent and characteristic behaviors, so defenders can understand and respond to the threat. Tactical intelligence instead focuses on immediately actionable technical details such as indicators and detection-relevant TTPs, while strategic intelligence addresses broader business-level trends and risks.

In Incident Review, selecting the active risk event count in the Risk Events column opens the Risk Event Timeline. The timeline displays the contributing risk events in chronological order and supports investigation of their associated risk objects.

Hash values are easily invalidated when an adversary makes even a minor change to a malicious file. Because attackers can rapidly generate a new hash, hash-based detections are fragile and provide the least durable value for continuous monitoring.

Risk factors are configurable rules or tuning factors that use specified conditions to increase, decrease, or otherwise adjust an asset’s or identity’s risk score dynamically.

Assets & Identities maintains asset records that associate IP addresses with DNS and Windows host names. Enterprise Security uses asset correlation to enrich network events with this asset context, so updating the asset and identity data restores host-name identification from network logs.

A security architect defines and designs the security architecture, including the infrastructure, platforms, and tools that enable security analysts to perform monitoring, investigation, and response activities.

A risk object is the asset or identity—such as a system or user account—to which Splunk Enterprise Security associates and aggregates risk events and scores. Multiple risk observations for the same user therefore apply to that user’s risk object.

A tactic represents the adversary’s goal or objective behind an action. Techniques describe the general methods used to achieve that goal, while procedures are the specific ways those techniques are carried out.

The Continuous Monitoring cycle starts with defining monitoring objectives and predicting relevant threats or risks. This establishes the scope and priorities for later monitoring, assessment, response, and recovery activities.

Reconnaissance is an attacker tactic because it represents the objective of gathering information about a target. Creating scheduled tasks, using phishing emails, and bypassing UAC are specific techniques used to achieve attacker objectives.

Annotations enrich Splunk Enterprise Security correlation searches with mappings to industry-standard security frameworks, including NIST. They provide the framework context as correlation-search metadata and can be displayed in Incident Review and Risk Analysis.

Splunk Fast mode disables field discovery for event searches, so it returns default/indexed fields but does not perform automatic search-time field extraction. Smart mode for an event search or Verbose mode enables field discovery and exposes the extractable XML fields.

A workflow action can be scoped to an IP address field and pass its value to an external web resource, such as a WHOIS or IP lookup service. Splunk supports GET workflow actions specifically for sending field values to external IP lookup services.

Splunk SOAR playbooks automate incident-response actions across integrated security tools. Containing a compromised host is a repeatable response workflow that can be orchestrated automatically.

MITRE ATT&CK classifies Brute Force (T1110), including Password Guessing with a list of common passwords, under the Credential Access tactic because the activity attempts to obtain valid account credentials.

A rootkit is designed to hide programs, files, processes, and network activity by modifying or hooking operating-system functions, including at user-mode or kernel-mode levels.

Replacing potentially compromised encryption keys prevents unauthorized parties from continuing to decrypt protected information, which safeguards confidentiality.

A procedure is a specific, real-world sequence used to carry out adversary behavior. This sequence specifies the tools, customized beacon profile, targeted email, malicious document, and temporary compromised-web infrastructure used to establish command-and-control.

The New Domain Analysis dashboard identifies domains that are newly registered or newly seen in the environment, with activity, age, top-level-domain, and registration-detail panels. Those signals are directly useful for detecting typosquatted lookalike domains.

Strategic threat intelligence provides leadership with a high-level view of the threat landscape, trends, risks, and implications for the organization to support informed business and security decisions.

MITRE ATT&CK defines techniques as the methods used to accomplish a tactical goal, tactics as the adversary’s goal, and procedures as specific implementations of techniques. Exploitation of Remote Services is a technique, Lateral Movement is a tactic, and exploiting a remote SMB server with EternalBlue is a specific procedure.

Splunk Enterprise Security Content Update (ESCU) is the packaged content service that delivers ongoing security content, including analytic stories and detection searches, for Splunk Enterprise Security. Those detections can produce findings that trigger Splunk SOAR playbooks when ES and SOAR are paired.

A procedure is the specific implementation of a technique by an adversary, such as using the named LoudMiner malware to perform resource hijacking for cryptocurrency mining.