The Splunk Enterprise Security Certified Admin exam helps in gaining expertise in Splunk Enterprise Security event processing, normalization, settings, threat intelligence, and protocol intelligence configuration. This exam will help you enhance your knowledge as a Splunk Enterprise Security Certified Admin. From deployment requirements and risk analysis settings to threat intelligence and customizations, candidates will gain the skills for tailoring implementation to your needs.

The exam is designed for:

The Exam covers the given topics  - 

1.1 Overview of ES features and concepts

2.1 Security posture

2.2 Incident review

2.3 Notable events management

2.4 Investigations

3.1 Overview of security intel tools

4.1 Explore forensics dashboards

4.2 Examine glass tables

4.3 Configure navigation and dashboard permissions

5.1 Identify deployment topologies

5.2 Examine the deployment checklist

5.3 Understand indexing strategy for ES

5.4 Understand ES Data Models

6.1 Prepare a Splunk environment for installation

6.2 Download and install ES on a search head

6.3 Understand ES Splunk user accounts and roles

6.4 Post-install configuration tasks

7.1 Plan ES inputs

7.2 Configure technology add-ons

8.1 Design a new add-on for custom data

8.2 Use the Add-on Builder to build a new add-on

9.1 Configure correlation search scheduling and sensitivity

9.2 Tune ES correlation searches

10.1 Create a custom correlation search

10.2 Configuring adaptive responses

10.3 Search export/import

11.1 Identify ES-specific lookups

11.2 Understand and configure lookup lists

12.1 Understand and configure threat intelligence

12.2 Configure user activity analysis