From the course: CompTIA SecurityX (CAS-005) Cert Prep

Unlock this course with a free trial

Join today to access over 24,300 courses taught by industry experts.

Detection and threat hunting

Detection and threat hunting

From the course: CompTIA SecurityX (CAS-005) Cert Prep

Start my 1-month free trial Buy for my team

Detection and threat hunting

“

- For this lesson, I'm going to do a web Safari up to Splunk, powered by Cisco. Splunk Enterprise is probably the defacto tool we can use for SIEM systems and SOAR systems for threat hunting, for visibility. And so, I want you to familiarize yourself with this product. If you don't want to look at this product, then you might want to take a look at something like Azure Sentinel, which you would use maybe in a hybrid cloud solution. But you can see on this diagram here, we can use this Splunk solution with third-party tools. We can use it in the public cloud, we can use it in our own on-prem data center. Maybe we have our own private cloud where we have our own hypervisors, our own devices, and even with custom and third-party apps and services. So the core areas here are events, logs, metrics, and traces. These are the events and informational data that's collected by a SIEM system, and then the actions are to manage, search, federate, and automate. And we can have different types of…

Contents