Splunk: An easy tool for cybersecurity professionals to monitor threats

Security information and event monitoring (SIEM) tools provide you with a snapshot of your IT infrastructure at any time and can help organizations catch internal and external threats quickly. They are an essential tool used in a security operations center (SOC) by SOC analysts and other cybersecurity professionals. One of the leaders in the SIEM category is Splunk.

This is partly because Splunk is designed to be intuitive to learn and clean to look at, said Infosec Skills author Gina Napier. 

"With Splunk, everything's sectioned off, and they clearly show you where you can type your commands. If you're typing a command, it will help you finish," said Napier, who teaches a six-course learning path on Splunk in Infosec Skills. "It's pretty easy for people to pick up because it's really intuitive."

Splunk Learning Path

When it comes to cybersecurity, Splunk is essentially used as a log analysis engine. "It's used to correlate security events, which allows you to identify where your breaches are coming from," said Napier. 

For example, there is likely a lot of activity on the edge devices when some of these large companies are getting hacked, said Napier. "If they had Splunk and an analyst that was able to monitor the activity in real-time, they may be able to catch those incidents before it got into the network."

Know where to look for security threats

With the increase in IoT devices, "everything's giving off data now, and you've got to secure everything," said Napier. But so much data we produce probably isn't going to be relevant to data analysts, so "the focus has been more on filtering out what you don't need."

Because so many devices gather so much data now, auditors have recently focused on filtering out less important data by "limiting the time range and limiting the sources" and being strategic about where to look. "If you know where the breaches come from, don't waste your time looking everywhere," said Napier. Instead, you should prioritize data that's the most valuable. "I would start with my edge devices and work my way in because the intruders are likely to come from the outside." At the same time, inside vulnerabilities are usually correctable employee mistakes.

If you don't know what to look for, you can use resources like the Sans standard log checklist to help you. Napier also recommends looking at your network, system and security logs.

Hands-on demonstrations show the value of Splunk

While much of the Advanced Splunk Core learning path is centered on learning to get data onto the Splunk platform, doing the actual security searches is the more hands-on part, said Napier. "That's where you get to really see why it's worth it, why it's worth setting up and why it's worth using."

At the end of the learning path, you also get to learn "how to deploy components just in case you have to do some of your own data modeling," said Napier. This is where you learn how to demonstrate your findings to a non-technical person. 

"For example, if you wanted to show an organization the value of Splunk, then you could upload some log files and do some analysis and show them the kind of information we can see if we were to use this tool."

"By monitoring security logs, you can identify activity that is caused by an attack rather than a user. For example, if a user has tried to log in 30 times in the last 30 seconds, then you can probably tell that's some kind of attack because most users can't type that fast." 

Who should take Splunk training?

The Advanced Splunk Core learning path focuses on analyzing data from a security perspective. You'll learn the basics of data analysis and data modeling, how to identify patterns and how to create visualizations, such as reports or charts to portray your findings to your team. 

Because the tool is so straightforward to use, students only need basic IT knowledge to get started. Napier said the only prerequisites are "knowing what a computer is, what an operating system is, and being able to think critically and be able to identify patterns. Other than that, the courses pretty much teach you everything else you need to know."

While Splunk is a relatively accessible tool, "you need to be able to think critically and identify patterns," said Napier. "The tool is aimed at people who need to identify security and knowledge anomalies. For example, you may want to see what someone is doing on the network after they've been fired."

With so much data being collected and logged, understanding how to collect, view and present that data using a tool like Splunk is a valuable skill for various roles, ranging from cybersecurity professionals to data analysts to human resources and other teams. 

Click below to create your free Infosec Skills account and browse Napier's Advanced Splunk Core training— plus 1,300+ other courses in Infosec Skills.

See Courses

Sources

• Critical Log Review Checklist for Security Incidents, SANS