The course covers the complete incident investigation workflow, Notable Event triage, threat hunting methodologies, MITRE ATT&CK mapping, and risk score analysis. You will also learn to create detection content directly aligned with real-world threat scenarios faced by modern security operations centers.
Whether you are a Tier 1 analyst looking to advance to Tier 2/3 or a threat hunter wanting to formalize your skills, this course provides the structured knowledge and hands-on practice you need to excel as an ES Analyst.
SOC Tier Structure & Analyst Roles : Understanding Tier 1, 2, and 3 analyst responsibilities and escalation paths in a SOC.
ES Interface for Analysts : Navigating the ES analyst interface: Incident Review, Security Posture, and investigation panels.
Alert Lifecycle in ES : From correlation search trigger to Notable Event creation to case closure.
Analyst Toolbelt Overview : Key dashboards and panels an ES analyst uses daily for effective security monitoring.
Course
Splunk Enterprise Security Analyst
No LMS account? Contact CCN office to get onboarded.
Ratings & Reviews
Average -
4.8★
Abhishek Rajan
1 month ago
Took me from Tier 1 to Tier 2 analyst!
The threat hunting and MITRE ATT&CK modules completely changed how I investigate incidents. Within two months of finishing this course, I was promoted to Tier 2 analyst.
Nithya Krishnamurthy
2 months ago
The best SOC analyst training I've seen
The real-world simulation labs are brilliant. The APT simulation lab in particular was an incredible learning experience that no textbook can replicate.
Gaurav Tiwari
3 weeks ago
Solid threat hunting content
The threat hunting section is exactly what I needed to upskill. Very comprehensive coverage of endpoint, network, and cloud hunting with practical SPL examples.
Lakshmi Rajagopalan
2 weeks ago
Got into a Threat Hunter role!
I had been trying to break into threat hunting for over a year. This course gave me the structured methodology and hands-on skills that finally got me hired as a dedicated Threat Hunter.
Frequently Asked Questions
Yes, this course is designed to help Tier 1 analysts advance to Tier 2/3 roles by providing structured investigation methodology, threat hunting skills, and detection engineering knowledge.
No, the course is designed for analysts using ES in analyst mode. Lab environments are pre-configured so you can focus on investigation and hunting without needing admin privileges.
The ES Analyst course focuses on using ES to investigate and hunt, while the ES Administration course focuses on deploying, configuring, and managing the ES platform itself. These courses complement each other.
Yes, Module 3 is dedicated entirely to MITRE ATT&CK, covering the matrix structure, ES integration, investigation tagging, and coverage gap analysis.
Absolutely. Module 15 contains four full attack simulation labs covering APT intrusions, insider threats, ransomware, and cloud compromises with complete investigation walkthroughs.
Get Free Counselling
Fill out the form below and our counsellor will get in touch with you shortly.
🔒 Your information is safe with us. No spam, ever.
