Splunk SPLK-1002: SPL Stats, Eval, and Transformations
SPL becomes analytically powerful when searches move beyond matching events and begin calculating, grouping, and reshaping them. The `eval` command creates or transforms…
Read articleEDITORIAL TOPIC / EXAMTOPICS EDITORIAL
Cybersecurity.
Identity, secure architectures, threats, vulnerabilities and defensive operations.
PUBLISHED COVERAGECurated by subject
Splunk SPLK-5001: CIM and Data Models for Security Analytics
The Splunk Common Information Model, or CIM, provides a vendor-neutral field and tag vocabulary for common data domains such as authentication, network traffic,…
Read articleSplunk SPLK-5001: Building Security Detections in Splunk
Within the Splunk security platform, a security detection is a repeatable analytical rule that identifies behavior worth investigating. In Splunk, detections typically begin…
Read articleSplunk SPLK-1002: Useful Splunk Dashboards
A useful Splunk dashboard is not a collection of every metric a team can display. It is a decision surface that helps a…
Read articleSplunk SPLK-1002: Lookups, Tags & Event Types in Splunk
Splunk knowledge objects let teams add reusable meaning to indexed events without changing the raw data. Lookups enrich events with external reference information,…
Read articleSplunk SPLK-1001: SPL Search Commands for Analysts
Splunk Search Processing Language, or SPL, turns indexed events into answers. Analysts use search terms to narrow data, field commands to shape events,…
Read articleSplunk SPLK-1001: How Splunk Indexing and Search Work
Splunk’s core workflow has two broad phases: events are ingested, parsed, indexed, and stored; later, users search those indexed events and transform results…
Read articleSplunk SPLK-1001: Fields, Extractions & Knowledge Objects
Splunk events become much more useful when raw text is enriched with fields and reusable knowledge. Fields let searches refer to meaningful values…
Read articleSplunk SPLK-1003: Forwarders & Distributed Architecture
Splunk Enterprise scales by separating data collection, indexing, search, and management responsibilities across components. Forwarders collect data from source systems and send it…
Read articleSalesforce Agentforce Specialist: Security & Governance for Salesforce AI Agents
Salesforce AI-agent security requires more than prompt filtering. An Agentforce deployment combines user identity, Salesforce permissions, data retrieval, prompt construction, model access, actions,…
Read articleRed Hat EX200: Firewalld and Network Security in RHEL
Red Hat Enterprise Linux uses firewalld as the standard high-level firewall management service in many installations. For administrators, the important skill is not…
Read articleCNCF KCSA: Supply Chain Security for Container Images
Container security begins long before a Pod starts. Source code, dependencies, build runners, base images, registries, signing keys, CI credentials, and deployment policy…
Read articleCNCF KCSA: Runtime Security for Kubernetes Clusters
Kubernetes security does not end when an image passes a registry scan and a Pod is admitted. Once a container is running, the…
Read articleCNCF KCSA: Kubernetes Security Contexts & Pod Security
Kubernetes does not make an application safe merely because it runs inside a container. Containers share the node kernel, and a poorly constrained…
Read articleHow IT Teams Use Network Device Logs for Security and Monitoring
Modern networks generate enormous amounts of information every second. Every connection request, login attempt, file transfer, configuration change, and application event leaves behind…
Read article