Program Title

Splunk Security Operations Masterclass: Email Security, SIEM & Endpoint Detection

Duration

5 Days
Recommended format: 6–7 hours per day
Mode: Instructor-led + hands-on labs + final SOC investigation project

Target Audience

This program is suitable for:

Prerequisites

Participants should have basic knowledge of:

Lab Environment

Recommended lab setup:

Important note: Splunk is not itself a replacement for a full EDR tool like CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, or Carbon Black. In this program, “Endpoint Security with Splunk” means collecting endpoint telemetry, normalizing it, detecting suspicious behavior, correlating with SIEM events, and supporting investigation/response.

Day 1 — Splunk Security Foundation & SOC Data Onboarding

Theme

Build the Splunk foundation required for SIEM, email security, and endpoint monitoring.

Learning Objectives

By the end of Day 1, students will understand:

Morning Session: Concepts

1. What is Splunk in Security?

Topics:

• Splunk as a security analytics platform
• Difference between log management, SIEM, SOAR, UEBA, and XDR
• Where Splunk Enterprise Security fits
• SOC workflow: collect → normalize → detect → investigate → respond → report

2. Splunk Architecture for Security

Topics:

• Splunk Enterprise
• Splunk Cloud
• Universal Forwarder
• Heavy Forwarder
• Indexer
• Search Head
• Deployment Server
• Apps and Add-ons
• Splunk Enterprise Security
• Splunk SOAR
• Splunk Attack Analyzer

3. Security Log Sources

Important data sources:

4. SPL Basics for Security

Core SPL commands:

index=* earliest=-24h

index=security sourcetype=windows:security EventCode=4625

index=email action=blocked
| stats count by sender, recipient, subject

index=endpoint process_name=powershell.exe
| table _time host user process_name command_line

index=* 
| stats count by sourcetype

Afternoon Hands-On Labs

Lab 1.1 — Explore Splunk Search

Tasks:

1. Login to Splunk.
2. Open Search & Reporting.
3. Search all available indexes.
4. Identify available sourcetypes.
5. Find top hosts sending logs.
6. Create a basic table of events.

Example SPL:

index=*
| stats count by index, sourcetype, host
| sort -count

Lab 1.2 — Create Security Indexes

Create sample indexes:

Lab 1.3 — Upload Sample Security Logs

Upload or ingest:

• Sample email logs
• Sample Windows security logs
• Sample Sysmon logs
• Sample DNS/proxy/firewall logs

Lab 1.4 — Basic Dashboard

Create a dashboard with:

Day 1 Deliverables

Students should produce:

• Data source inventory
• Basic Splunk searches
• Security indexes
• First SOC visibility dashboard

Day 2 — Splunk SIEM with Enterprise Security Concepts

Theme

Learn how Splunk works as a SIEM: correlation, notable events, dashboards, risk-based alerting, and investigations.

Splunk Enterprise Security uses correlation searches and risk-based alerting concepts to help SOC teams reduce alert noise and prioritize higher-risk activity. (Splunk Docs)

Learning Objectives

By the end of Day 2, students will understand:

Morning Session: Concepts

1. What is SIEM?

SIEM stands for Security Information and Event Management.

Core SIEM capabilities:

2. Splunk Enterprise Security Overview

Topics:

• Security posture dashboards
• Incident Review
• Notable events
• Correlation searches
• Asset and identity framework
• Threat intelligence framework
• Risk-based alerting
• Investigation workflow
• Security domains

3. SIEM Detection Engineering

Detection design structure:

4. Risk-Based Alerting

Traditional alerting:

One rule fires = one alert

Risk-based alerting:

Multiple suspicious events + same user/host = higher risk score

Example:

Afternoon Hands-On Labs

Lab 2.1 — Failed Login Detection

Use failed authentication events.

Example SPL:

index=endpoint_security EventCode=4625
| stats count by user, src_ip
| where count > 5
| sort -count

Lab 2.2 — Brute Force Followed by Success

index=endpoint_security (EventCode=4625 OR EventCode=4624)
| stats 
    count(eval(EventCode=4625)) as failed_logins
    count(eval(EventCode=4624)) as successful_logins
    values(src_ip) as src_ip
    by user
| where failed_logins >= 5 AND successful_logins >= 1
Code language: JavaScript (javascript)

Lab 2.3 — Create a Correlation Search

Detection name:

Multiple Failed Logins Followed by Success

Severity:

High

MITRE mapping:

Credential Access / Brute Force

Action:

Create notable event or alert

Lab 2.4 — Threat Intel IOC Matching

Sample IOC lookup:

ioc,type,severity
malicious-domain.com,domain,high
185.10.20.30,ip,critical
badfilehash123,hash,high
Code language: CSS (css)

Example SPL:

index=proxy OR index=dns
| lookup threat_ioc_lookup ioc as query OUTPUT severity type
| where isnotnull(severity)
| table _time host user query type severity
Code language: JavaScript (javascript)

Lab 2.5 — SIEM Dashboard

Create panels:

Day 2 Deliverables

Students should produce:

• SIEM detection search
• Correlation search design
• Threat intelligence lookup
• SOC triage dashboard
• Basic investigation workflow

Day 3 — Splunk for Email Security & Phishing Investigation

Theme

Detect and investigate phishing, malicious attachments, suspicious links, spoofing, and compromised mailboxes.

Splunk Attack Analyzer can automate analysis of phishing and malware threats, including suspicious emails, URLs, files, and attack chains. Splunk documentation also describes phishing investigation workflows inside Splunk Enterprise Security powered by Attack Analyzer. (Splunk Lantern)

Learning Objectives

By the end of Day 3, students will understand:

Morning Session: Concepts

1. Email Security Fundamentals

Common email threats:

2. Important Email Security Fields

3. Email Authentication Concepts

Students should understand:

4. Phishing Investigation Workflow

Recommended workflow:

Suspicious Email Alert
        ↓
Check Sender Reputation
        ↓
Analyze Subject and Body
        ↓
Extract URLs and Attachments
        ↓
Check Recipients
        ↓
Check Click Activity
        ↓
Check Endpoint Activity
        ↓
Contain Mailbox / Host
        ↓
Close Investigation

Afternoon Hands-On Labs

Lab 3.1 — Top Suspicious Email Senders

index=email_security
| stats count by sender, sender_domain, action, verdict
| sort -count

Lab 3.2 — Detect External Sender Spoofing Internal Domain

index=email_security sender_domain="company.com" src_ip!="trusted_mail_gateway_ip"
| table _time sender recipient subject src_ip action verdict
Code language: JavaScript (javascript)

Lab 3.3 — Detect Malicious Attachments

index=email_security attachment_name=*
| eval suspicious_attachment=if(match(attachment_name, "\.(exe|scr|js|vbs|hta|iso|img|lnk)$"), "yes", "no")
| where suspicious_attachment="yes"
| table _time sender recipient subject attachment_name verdict action
Code language: JavaScript (javascript)

Lab 3.4 — Detect Suspicious URLs

index=email_security url=*
| eval suspicious_url=if(match(url, "(login|verify|password|invoice|payment|secure)"), "yes", "no")
| where suspicious_url="yes"
| stats count values(url) as urls by sender, recipient, subject
Code language: JavaScript (javascript)

Lab 3.5 — Phishing Campaign Detection

index=email_security
| stats 
    dc(recipient) as unique_recipients
    values(recipient) as recipients
    values(url) as urls
    values(attachment_name) as attachments
    by sender, subject
| where unique_recipients > 10
| sort -unique_recipients
Code language: JavaScript (javascript)

Lab 3.6 — Email-to-Endpoint Pivot

Scenario:

A user received a phishing email and clicked a URL. Now check endpoint activity.

Step 1: Find recipient.

index=email_security verdict=malicious
| table _time sender recipient subject url attachment_name

Step 2: Pivot to endpoint.

index=endpoint_security user="victim.user"
| table _time host user process_name command_line parent_process_name
Code language: JavaScript (javascript)

Step 3: Look for suspicious browser or PowerShell activity.

index=endpoint_security user="victim.user"
(process_name="powershell.exe" OR process_name="cmd.exe" OR process_name="wscript.exe" OR process_name="mshta.exe")
| table _time host user process_name command_line parent_process_name
Code language: JavaScript (javascript)

Lab 3.7 — Email Security Dashboard

Create dashboard panels:

Day 3 Deliverables

Students should produce:

• Email security search pack
• Phishing investigation workflow
• Email security dashboard
• Email-to-endpoint pivot process
• Phishing campaign detection report

Day 4 — Splunk for Endpoint Security

Theme

Detect suspicious endpoint behavior using Windows, Linux, Sysmon, EDR, and process telemetry.

The Splunk CIM Endpoint data model is designed for monitoring endpoint clients such as user machines and laptops. It covers endpoint-related events such as processes, services, files, and ports. (docs.splunk.com)

Learning Objectives

By the end of Day 4, students will understand:

Morning Session: Concepts

1. Endpoint Security Data Sources

2. Important Windows Event IDs

3. Endpoint Attack Behaviors

4. Endpoint Detection Workflow

Endpoint Alert
     ↓
Identify Host and User
     ↓
Review Process Tree
     ↓
Check Parent/Child Process
     ↓
Check Network Connections
     ↓
Check File/Registry Changes
     ↓
Correlate with Email, DNS, Proxy, Identity
     ↓
Contain or Escalate
Code language: JavaScript (javascript)

Afternoon Hands-On Labs

Lab 4.1 — Suspicious PowerShell Detection

index=endpoint_security process_name="powershell.exe"
| where match(command_line, "(?i)(-enc|encodedcommand|downloadstring|iex|invoke-expression|bypass)")
| table _time host user parent_process_name process_name command_line
Code language: JavaScript (javascript)

Lab 4.2 — Office Application Spawning Script Interpreter

index=endpoint_security
(parent_process_name="winword.exe" OR parent_process_name="excel.exe" OR parent_process_name="outlook.exe")
(process_name="powershell.exe" OR process_name="cmd.exe" OR process_name="wscript.exe" OR process_name="mshta.exe")
| table _time host user parent_process_name process_name command_line
Code language: JavaScript (javascript)

Lab 4.3 — New Service Installation

index=endpoint_security EventCode=7045
| table _time host user service_name service_file_name

Lab 4.4 — Privileged User Group Change

index=endpoint_security EventCode IN (4728,4732)
| table _time host user member_name group_name

Lab 4.5 — Linux SSH Brute Force

index=endpoint_security sourcetype=linux_secure "Failed password"
| rex "from (?<src_ip>\d+\.\d+\.\d+\.\d+)"
| stats count by src_ip, host
| where count > 10
| sort -count
Code language: JavaScript (javascript)

Lab 4.6 — Suspicious Linux Sudo Activity

index=endpoint_security sourcetype=linux_secure sudo
| stats count values(command) as commands by user, host
| sort -count
Code language: JavaScript (javascript)

Lab 4.7 — Endpoint Investigation Dashboard

Create panels:

Day 4 Deliverables

Students should produce:

• Endpoint detection search pack
• Windows endpoint dashboard
• Linux endpoint dashboard
• Endpoint investigation playbook
• MITRE ATT&CK mapping for endpoint detections

Day 5 — Integrated SOC Capstone: Email + SIEM + Endpoint Security

Theme

Students complete a realistic SOC investigation from phishing email to endpoint compromise and SIEM reporting.

Learning Objectives

By the end of Day 5, students will be able to:

Capstone Scenario

Scenario Name

Phishing Email Leading to Endpoint Compromise

Story

A user receives an email with the subject:

Urgent: Password Verification Required
Code language: HTTP (http)

The user clicks a suspicious URL. Shortly after, the endpoint executes PowerShell with an encoded command. The host then communicates with an unknown external IP address. The SOC must investigate and determine whether the incident is a true positive.

Data Sources Used

Morning Session: Guided Capstone Build

Step 1 — Identify Suspicious Email

index=email_security
(subject="*Password Verification*" OR subject="*Urgent*")
| table _time sender recipient subject url attachment_name verdict action
Code language: JavaScript (javascript)

Step 2 — Find All Recipients

index=email_security subject="*Password Verification*"
| stats values(recipient) as recipients dc(recipient) as recipient_count by sender, subject, url
Code language: JavaScript (javascript)

Step 3 — Identify Clicked URL

index=proxy OR index=email_security url=*
| search url="*verification*"
| table _time user src_ip url action
Code language: JavaScript (javascript)

Step 4 — Pivot to Endpoint

index=endpoint_security user="victim.user"
| table _time host user process_name parent_process_name command_line
Code language: JavaScript (javascript)

Step 5 — Detect Suspicious PowerShell

index=endpoint_security user="victim.user" process_name="powershell.exe"
| where match(command_line, "(?i)(-enc|downloadstring|iex|bypass)")
| table _time host user parent_process_name process_name command_line
Code language: JavaScript (javascript)

Step 6 — Check External Communication

index=dns OR index=proxy
user="victim.user"
| stats values(query) as domains values(dest_ip) as dest_ips by user, src_ip
Code language: JavaScript (javascript)

Step 7 — Check Threat Intel

index=dns OR index=proxy
| lookup threat_ioc_lookup ioc as query OUTPUT severity type
| where isnotnull(severity)
| table _time user src_ip query type severity
Code language: JavaScript (javascript)

Afternoon Session: Final Project

Students must build the following:

1. Detection Rules

2. Risk Scoring Model

Example:

Final risk logic:

If total risk score >= 80, create high severity notable event.

3. SOC Dashboard

Required panels:

4. Incident Report

Students must prepare a final incident report with:

Day 5 Deliverables

Students should submit:

• Final SOC dashboard
• Detection rule pack
• Risk scoring logic
• Incident investigation timeline
• Final incident report
• Presentation of findings

Complete 5-Day Agenda Summary

Recommended Practical Assignments

Assignment 1 — SPL Search Practice

Create 10 SPL searches:

1. Top email senders
2. Top email recipients
3. Failed logins by user
4. Failed logins by source IP
5. Suspicious PowerShell
6. New service installed
7. Suspicious attachment
8. Malicious URL click
9. IOC match
10. User risk summary

Assignment 2 — Email Security Dashboard

Build a dashboard containing:

• Delivered vs blocked emails
• Top suspicious senders
• Top targeted recipients
• Suspicious attachments
• Suspicious URLs
• Phishing campaign view

Assignment 3 — Endpoint Security Dashboard

Build a dashboard containing:

• Top risky hosts
• Top risky users
• Suspicious PowerShell
• Office spawning command shell
• Failed login trend
• New service installation

Assignment 4 — SIEM Detection Engineering

Create three detections:

Assignment 5 — Final SOC Investigation

Investigate one complete incident and submit:

• Timeline
• Evidence
• IOCs
• Affected users
• Affected hosts
• Final verdict
• Recommended response

Final Project Evaluation Rubric

Course Outcome

After this 5-day program, students should be able to:

1. Use Splunk for real-world SOC investigations.
2. Onboard and search email, endpoint, identity, and network logs.
3. Build SIEM detections using SPL.
4. Investigate phishing and malicious email campaigns.
5. Detect suspicious endpoint behavior.
6. Correlate email and endpoint events into one attack story.
7. Build SOC dashboards and incident reports.
8. Understand how Splunk Enterprise Security, SOAR, and Attack Analyzer fit into a modern SOC workflow.

Rajesh Kumar

I’m a DevOps/SRE/DevSecOps/Cloud Expert passionate about sharing knowledge and experiences. I have worked at Cotocus. I share tech blog at DevOps School, travel stories at Holiday Landmark, stock market tips at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow , and SEO strategies at Wizbrand.

Do you want to learn Quantum Computing?

Please find my social handles as below;

Rajesh Kumar Personal Website
Rajesh Kumar at YOUTUBE
Rajesh Kumar at INSTAGRAM
Rajesh Kumar at X
Rajesh Kumar at FACEBOOK
Rajesh Kumar at LINKEDIN
Rajesh Kumar at WIZBRAND

Rajesh Kumar DailyLogs