| トピック | 出題範囲 |
|---|
| トピック 1 | - Splunk Authentication Management: This domain is intended for Security Operations Engineers and involves integrating LDAP directories, implementing multi-factor authentication, and exploring other authentication mechanisms within Splunk.
|
| トピック 2 | - Parsing Phase and Data: Security Operations Engineers are tested on their understanding of event parsing, timestamp recognition, and the use of data preview tools to verify data correctness prior to indexing.
|
| トピック 3 | - Agentless Inputs: Designed for Security Operations Engineers, this section covers creating agentless inputs using WMI and HTTP Event Collector (HEC), particularly for integrating data from Windows and RESTful sources.
|
| トピック 4 | - Manipulating Raw Data: Aimed at Splunk Administrators, this section covers using configuration files to mask, re-route, or suppress data at index time using props.conf, transforms.conf, and SEDCMD.
|
| トピック 5 | - Splunk Indexes: Relevant to Splunk Administrators, this section covers the structure and types of index buckets, data retention policies, integrity checks, and the role of the fishbucket in tracking file inputs.
|
| トピック 6 | - Fine Tuning Inputs: Splunk Administrators are evaluated on their ability to customise input processing, including sourcetype identification, character encoding, and other configurations for accurate data onboarding.
|
| トピック 7 | - Network and Scripted Inputs: Security Operations Engineers are assessed on setting up and customising TCP and UDP network inputs, as well as implementing basic scripted inputs for dynamic data ingestion.
|
| トピック 8 | - Getting Data In: This domain addresses the responsibilities of Splunk Administrators in configuring data inputs, differentiating forwarder types, and using the command-line interface for setting up Universal Forwarders.
|
| トピック 9 | - Splunk User Management: Aimed at Splunk Administrators, this area focuses on user account creation, role-based access controls, and custom role development to maintain a secure and organised user environment.
|