Advanced SOAR Implementation

Duration : 2 Days (16 Hours)

Advanced SOAR Implementation Course Overview:

This course is designed for experienced SOAR consultants who are responsible for complex SOAR solution development. It aims to equip attendees with the skills needed to integrate SOAR with Splunk and create playbooks that involve custom coding and REST API usage.

Prospective participants should have successfully completed all prerequisite courses and be prepared to fully commit their attention to this challenging coursework. During the course, students will work on developing a custom solution that utilizes SOAR, Splunk, and custom Python code. The labs will outline the solution requirements, and students will be responsible for planning and executing the development process. This will demand careful focus, experimentation, and problem-solving abilities.

Intended Audience:

  • Experienced SOAR Consultants: Individuals who have experience in SOAR solution development and are responsible for complex SOAR solution development.
  • Technical Professionals: IT and security practitioners who want to integrate Splunk and SOAR, as well as develop playbooks requiring custom coding and REST API usage.
  • Splunk Administrators: Those who have experience in administering Splunk and want to extend their knowledge to include SOAR integration.
  • Splunk Developers: Professionals who have experience in developing Splunk SOAR Playbooks or similar automation workflows.
  • Python Programmers: Individuals with experience in Python programming, as custom coding is a part of the course.
  • Splunk Enterprise Administrators: Professionals who have experience in administering Splunk Enterprise, especially those with expertise in Splunk Enterprise Data Administration and System Administration.
  • Splunk Enterprise Security (ES) Users/Administrators: Those familiar with using or administering Splunk Enterprise Security, as the course involves integrating SOAR with ES.

Learning Objectives of Advanced SOAR Implementation:

  • Using External Splunk Search in SOAR: Learn to seamlessly integrate external Splunk searches into SOAR workflows.
  • Sending Events from Splunk to SOAR: Understand how to forward events from Splunk to SOAR for further analysis and response.
  • Updating Splunk Events from SOAR: Gain the ability to modify and update Splunk events directly from within the SOAR platform.
  • Running SOAR Reports on Splunk: Discover how to generate and run SOAR reports within the Splunk environment for enhanced insights.
  • Executing SOAR Playbooks from Splunk: Learn how to trigger and execute SOAR playbooks directly from the Splunk interface, enabling automated incident response.
  • Searching Splunk from SOAR Playbooks: Harness the power to initiate searches within Splunk from within SOAR playbooks, streamlining investigative processes.
  • Writing Custom Code for Use in SOAR Playbooks: Develop custom Python code to extend the functionality of SOAR playbooks, tailored to specific use cases.
  • Using the SOAR REST API in SOAR Playbooks: Leverage the SOAR REST API within playbooks to enable seamless integration and automation.

Module 1 – Implementing Splunk and SOAR

  • Review of SOAR UI and concepts
  • Describe interactions between Splunk and SOAR
  • Identify key concepts and data flows
  • Prerequisites for integration

Module 2 – Configuring External Splunk Search

  • Describe the benefits of externalizing search to Splunk
  • Configure the SOAR instance for externalization
  • Configure the Splunk instance for externalization
  • Use the Splunk app for SOAR Reporting

Module 3 – Sending Splunk Events to SOAR

  • Configure the SOAR Add-on for Splunk
  • Map CIM fields to CEF
  • Send Enterprise Security notables to SOAR
  • Automatically trigger SOAR playbooks for Splunk notables

Module 4 – Accessing Splunk from SOAR

  • Install and configure the SOAR App for Splunk
  • Ingest Splunk events into SOAR
  • Use Splunk search from playbooks
  • Update Splunk notable events

Module 5 – Custom Coding in Playbooks

  • SOAR coding best practices
  • Writing, using, and managing custom functions
  • Using the SOAR API in custom code
  • Store and retrieve persistent data

Module 6 – Using SOAR REST

  • Use Django queries to search for data in SOAR
  • Use REST to access SOAR data
  • Use the HTTP app to execute REST from playbooks

Advanced SOAR Implementation Course Prerequisites:

To excel in this advanced course, attendees must ensure they meet all prerequisite requirements. This class is designed to be challenging and assumes a strong technical foundation in various aspects of Splunk and SOAR. The intensive labs and course schedule allow limited time for foundational learning.

Successful students should possess a solid understanding of the following:

  • Experience with Python Programming: Proficiency in Python programming is essential for custom coding and automation tasks.
  • Administering Splunk SOAR: Familiarity with administering Splunk SOAR is crucial for managing the platform effectively.
  • Developing Splunk SOAR Playbooks: Prior experience in creating and managing SOAR playbooks is necessary to navigate complex playbook development.
  • Enterprise Splunk Data Administration: Understanding the administration of Splunk data at an enterprise level is beneficial for data handling and integration tasks.
  • Enterprise Splunk System Administration: Proficiency in system administration for Splunk at an enterprise scale is essential for managing resources and configurations.
  • Experience in Using or Administering Splunk Enterprise Security: Knowledge of Splunk Enterprise Security is advantageous for integrating security-related workflows and data into SOAR solutions.

Discover the perfect fit for your learning journey

Choose Learning Modality

Live Online

  • Convenience
  • Cost-effective
  • Self-paced learning
  • Scalability

Classroom

  • Interaction and collaboration
  • Networking opportunities
  • Real-time feedback
  • Personal attention

Onsite

  • Familiar environment
  • Confidentiality
  • Team building
  • Immediate application

Training Exclusives

This course comes with following benefits:

  • Practice Labs.
  • Get Trained by Certified Trainers.
  • Access to the recordings of your class sessions for 90 days.
  • Digital courseware
  • Experience 24*7 learner support.

Got more questions? We’re all ears and ready to assist!

Request More Details

Please enable JavaScript in your browser to complete this form.

Subscribe to our Newsletter

Please enable JavaScript in your browser to complete this form.
×