Track A · Splunk
Architecture, forwarders, indexes, SPL, field extraction, dashboards, alerts, Enterprise Security, correlation + RBA, MITRE, SOAR playbooks, hunting, SOC use cases, SPLK-1003 / 3001.
Splunk SIEM & Microsoft Sentinel — Dual SIEM Track
Also discoverable via free Techclick lessons for Google search and AI tools (ChatGPT, Gemini, Perplexity) — blogs, interview Q&A and practice exams linked below.
Equal-depth dual platform syllabus: Splunk Enterprise + ES + SOAR and Microsoft Sentinel + KQL + SC-200 workflow — built for SOC L2 / L3 engineers.
📚 28 Modules (14 + 14)
⏱ ~70–80 Hours
🧪 Splunk + Sentinel Labs
🏆 SPLK + SC-200 Aligned
Dual SIEM Overview
Why both on one syllabus: large enterprises still run Splunk; Microsoft shops run Sentinel. SOC hiring increasingly expects analysts who can work both. This page now gives equal module depth for each platform (14 + 14). For the Microsoft-only SC-200 deep path (Defender XDR + Copilot), also see microsoft-sentinel.
Track B · Microsoft Sentinel
Workspace & connectors, ASIM, KQL, analytics rules, incidents, workbooks, UEBA, automation / Logic Apps, MITRE coverage, hunting, Defender XDR join, SOC use cases, SC-200 readiness.
Who Is This For
- SOC L1 / L2 analysts upgrading to L3 / detection engineering
- Engineers running Splunk Enterprise (on-prem or cloud) or joining a Microsoft SOC
- Analysts who need both SPL and KQL for multi-SIEM environments
- SOAR / automation engineers writing Splunk SOAR or Sentinel playbooks
- SPLK-1003 / SPLK-3001 and SC-200 candidates
Prerequisites
- SOC fundamentals — alerts, incidents, MITRE ATT&CK basics
- Some Linux CLI exposure (helpful for Splunk admin topics)
- Basic Microsoft 365 / Azure familiarity is useful for Sentinel (not mandatory)
- No prior SPL or KQL required — both languages start from foundations
Track A · Splunk SIEM & SOAR — 14 Modules
Splunk · Platform, data & search
S 1Splunk Architecture & Components
- Indexer, Search Head, Forwarder roles
- Distributed search
- Splunk Cloud vs Enterprise
- Index time vs search time
S 2Data Onboarding & Forwarders
- Universal Forwarder, Heavy Forwarder
- props.conf, transforms.conf
- Sourcetypes, source, host fields
- HEC (HTTP Event Collector)
S 3Indexes, Buckets & Retention
- Index design
- Hot / Warm / Cold / Frozen buckets
- Retention policies
- SmartStore basics
S 4SPL — Search Processing Language
- Basic search syntax
- stats, eval, where, top, rare
- Time modifiers, subsearches
- Lookups & KV Store
S 5Field Extraction & Parsing
- Auto extraction vs manual
- regex (rex) operator
- Field aliases & calculated fields
- Tags & event types
S 6Dashboards & Visualizations
- Classic dashboards (XML)
- Dashboard Studio
- Drill-down, tokens
- Sharing & permissions
S 7Alerts & Reports
- Scheduled vs real-time alerts
- Throttle, suppress
- Alert actions — email, webhook, script
- Reports & pivots
Splunk · Enterprise Security, SOAR & hunting
S 8Splunk ES — Enterprise Security
- ES architecture & CIM
- Data Models, accelerated
- Notable Events & Risk Object
- Incident Review workflow
S 9Correlation Searches & RBA
- Correlation search authoring
- Risk-Based Alerting (RBA)
- Risk modifiers
- Tuning false positives
S 10MITRE ATT&CK Mapping
- ATT&CK on Splunk dashboards
- Detections per tactic / technique
- Coverage gap analysis
- Threat-informed defense
S 11Splunk SOAR — Playbooks
- SOAR architecture
- Playbook builder & visual editor
- Common playbooks — phish, malware, brute force
- Apps & Assets
S 12Threat Hunting
- Hunt hypothesis methodology
- Lateral movement, persistence, exfil hunts
- Behavioral baselining
- Threat Intel enrichment
S 13Real-World SOC Use Cases
- Phishing chain investigation
- Insider exfil detection
- Ransomware kill chain
- Cloud audit log abuse
S 14Cert Path & Interview Prep (Splunk)
- SPLK-1003 (Splunk Admin)
- SPLK-3001 (ES Certified Admin)
- SOC L2 / L3 interview question bank (SPL + ES)
Track B · Microsoft Sentinel — 14 Modules
Balanced with Splunk: this track mirrors platform → language → detections → response → automation → hunting → certs. Full SC-200 Defender XDR depth lives at /syllabus/microsoft-sentinel; here we keep the dual-SIEM focus equal and practical.
Sentinel · Platform, data & KQL
M 1Sentinel Architecture & Azure SOC Components
- Log Analytics workspace + Sentinel enablement
- Microsoft Defender XDR and Sentinel unified portal experience
- Roles, RBAC, resource groups and least-privilege SOC access
- Multi-workspace / multi-tenant patterns for MSSP and enterprise
M 2Data Connectors & Onboarding
- Microsoft connectors — Entra ID, M365, Defender, Azure Activity
- Windows Security Events, Syslog / CEF, Common Event Format
- AMA (Azure Monitor Agent), DCR (data collection rules)
- Third-party firewall / proxy / identity sources
M 3Tables, Retention, Cost & Data Quality
- Analytics tier, Basic logs, Archive / long-term retention
- Ingestion cost drivers and filtering before ingest
- Table schemas: SecurityEvent, SigninLogs, CommonSecurityLog, Device*
- Health monitoring — connector status, data latency, missing sources
M 4KQL Foundations for SOC
- Table selection, time windows, project / extend / where
- summarize, top, order, distinct, bin, make-series
- parse, extract, split, bag_unpack for messy fields
- Join types, union, let statements and reusable query style
M 5ASIM Normalization & Parsers
- Why normalization matters for multi-source SOC
- ASIM schemas — NetworkSession, Authentication, ProcessEvent, Dns
- Built-in and custom parsers
- Writing detections against normalized fields (not raw only)
M 6Workbooks, Watchlists & Content Hub
- Workbook parameters, visuals, drill-downs for SOC dashboards
- Watchlists for allow/block lists, VIP users, critical assets
- Content Hub solutions and solution updates
- Sharing workbooks with analysts vs admins
M 7Analytics Rules & Detection Engineering
- Scheduled, NRT, ML Behavior Analytics, Fusion rule types
- Rule authoring from KQL — severity, tactics, entities
- Alert grouping, suppression, entity mapping
- False-positive tuning and detection feedback loops
Sentinel · Incidents, automation, hunting & certs
M 8Incidents, Investigation & Case Flow
- Incident queue — severity, owner, status, tags, tasks
- Investigation graph, entities, bookmarks, evidence
- Timeline reconstruction and multi-alert correlation
- Closing with classification, comment quality and lessons learned
M 9UEBA, Anomalies & Threat Intelligence
- User and Entity Behavior Analytics concepts in Sentinel
- Anomaly detections and baseline-driven alerts
- Threat intelligence indicators, TAXII / STIX style feeds
- Enrichment during triage (IP, domain, hash, user)
M 10Automation Rules & Logic Apps Playbooks
- Automation rule triggers, conditions, order and expiry
- Playbooks for enrichment, assignment, disable user, block IP
- Managed identities and connector security for Logic Apps
- Safe automation — change control and blast-radius thinking
M 11MITRE ATT&CK Coverage & SOC Optimization
- MITRE matrix coverage in Sentinel workbooks
- Mapping analytics rules to tactics / techniques
- SOC optimization recommendations and coverage gaps
- Threat-informed detection roadmap for the batch project
M 12Threat Hunting with KQL
- Hunt hypothesis → query → bookmark → incident path
- Identity abuse, lateral movement, persistence, exfil patterns
- Advanced hunting across Defender tables when XDR is connected
- Reusable hunting packs for the team notebook
M 13Real-World SOC Use Cases (Sentinel)
- Phishing → mailbox compromise → lateral movement chain
- Impossible travel / risky sign-in + device correlation
- Ransomware early signals (mass encryption prep, LOLBins)
- Cloud audit / privileged role abuse in Azure / Entra
M 14SC-200 Path & Interview Prep (Microsoft)
- SC-200 domain map: manage SOC env · respond · hunt
- How this dual track overlaps the official Microsoft blueprint
- Microsoft SOC interview bank — KQL, incidents, playbooks
- Deep SC-200 / Defender XDR page: microsoft-sentinel
Splunk ↔ Sentinel Skill Map
- Search language: SPL (S4–S5) ↔ KQL (M4–M5)
- Data onboarding: UF / HF / HEC (S2) ↔ Connectors / AMA / DCR (M2)
- Schema: CIM / Data Models (S8) ↔ ASIM (M5)
- Detections: Correlation + RBA (S9) ↔ Analytics rules (M7)
- Casework: Notable Events / Incident Review (S8) ↔ Incidents & investigation graph (M8)
- Automation: Splunk SOAR (S11) ↔ Automation rules + Logic Apps (M10)
- Dashboards: Dashboard Studio (S6) ↔ Workbooks (M6)
- Hunting: SPL hunts (S12) ↔ KQL hunts + bookmarks (M12)
What You Get
🎥
~70–80 Hours
Live + recorded across Splunk Enterprise/ES/SOAR and Microsoft Sentinel/KQL.
🧪
Dual Labs
Splunk free trial + sample data and Sentinel/Log Analytics style KQL + rule labs.
🛠️
Real Case Studies
Phish, ransomware, insider exfil, cloud audit abuse — practiced on both platforms where relevant.
📝
Interview Q&A
SOC L2 / L3 banks for SPL, ES, KQL and Sentinel incidents.
🏆
Certificate
Techclick Infosec course completion certificate after requirements are met.
💬
WhatsApp Group
Doubt-clearing batch group with the trainer.
Your Instructor
Trained by working senior cloud and network security engineers with 13+ years of hands-on enterprise experience across Splunk, Microsoft Sentinel, SIEM operations, detection engineering and large-scale SOC builds.
Official References
Use these vendor or standards-body sources as the current source of truth. Products, interfaces and certification blueprints change independently — re-check before each batch.
- Splunk Enterprise Security documentation
- Splunk Search Manual
- Microsoft Sentinel documentation
- Kusto Query Language (KQL)
- SC-200 study guide
Techclick provides independent training and is not affiliated with or endorsed by Splunk or Microsoft.
FAQ
Q 1Is this only Splunk or also Sentinel?
Both. Track A is full Splunk (14 modules). Track B is equal-depth Microsoft Sentinel (14 modules). The page was expanded so Sentinel is no longer only a short FAQ mention.
Q 2Hands-on labs?
Yes — Splunk Enterprise free trial / sample data for SPL and ES-style work, plus Sentinel / KQL practice for rules, workbooks and hunting queries.
Q 3Splunk vs Sentinel — which should I learn first?
If your target employer is a Microsoft shop, start with Track B (KQL). If you are joining a large enterprise SIEM team, start with Track A (SPL). Most SOC job descriptions benefit from both — that is why this syllabus keeps them equal.
Q 4Cert path?
Splunk: SPLK-1003 (Admin) and SPLK-3001 (ES). Microsoft: SC-200 Security Operations Analyst. S14 and M14 map both paths. Deeper SC-200/Defender modules: microsoft-sentinel.
Q 5Duration?
About 70–80 hours across both tracks (roughly 5–8 weeks depending on batch pace). Single-platform focus can be scheduled if needed — ask on WhatsApp.
Q 6Placement help?
CV review and interview prep for SOC L2 / L3. Outcomes depend on effort, background and market — we do not guarantee a job.
Master both of the SOC analyst's core SIEMs.
Talk to us about the next dual Splunk + Microsoft Sentinel batch.