| Topic | Details |
|---|
| Topic 1 | - User Management: User Management in the SPLK-2003 exam tests candidates on adding users, configuring authentication, and creating roles. SOC analysts and administrators who attempt the exam must manage user access and permissions.
|
| Topic 2 | - System Maintenance: The Splunk SPLK-2003 exam assesses candidates on their ability to monitor and maintain SOAR's performance. Understanding reports, system health, and logs is crucial for cybersecurity professionals to pass the test.
|
| Topic 3 | - Visual Playbook Editor: Sub-topics are about using the editor, executing actions from playbooks, and testing new playbooks. Cybersecurity professionals who attempt the Splunk SOAR Certified Automation Developer exam must learn how to create and modify automated workflows by using SOAR’s visual interface.
|
| Topic 4 | - Logic, Filters, and User Interaction: It focuses on usage of decision blocks, join options, filter blocks, and user interaction features. SOC analysts must get knowledge about interactive playbooks as well.
|
| Topic 5 | - Introduction to Playbooks: Sub-topics are about available app actions, automation best practices, I2A2 design methodology, and playbook capabilities. To pass the Splunk SPLK-2003 exam, applicant must get knowledge about these concepts to ensure success.
|
| Topic 6 | - Custom Coding: The primary focus of this topic is on writing custom SOAR code, using the global block, and custom function blocks.
|
| Topic 7 | - Modular Playbook Development: Designing modular solutions and invoking child playbooks for scalable and reusable components is the focus here. This enhances automation efficiency, a key skill for those aiming to take the SPLK-2003 exam.
|
| Topic 8 | - Apps, Assets, and Playbooks: Cybersecurity professionals should understand assets, configuring apps, and data ingestion for the SPLK-2003 exam. Proficiency in these areas enhances SOAR's automation and security tool integration.
|
| Topic 9 | - Customizations: Candidates of the Splunk SOAR Certified Automation Developer test learn to tailor SOAR to meet organizational needs, covering customization of severity levels, CEF fields, and workbooks. This topic is essential for those aiming to take the SPLK-2003 exam.
|
| Topic 10 | - Analyst Queue: The Analyst Queue topic focuses on search features and filter creation. SOC analysts who attempt the Splunk SOAR Certified Automation Developer exam must prepare to manage and prioritize security events effectively within the SOAR platform.
|
| Topic 11 | - Configuring External Splunk Search: In this topic of the SPLK-2003 exam, cybersecurity professionals learn about using reindex and reporting features, configuring both SOAR and Splunk instances, and externalizing search to Splunk.
|
| Topic 12 | - Formatted Output and Data Access: Formatted Output and Data Access topic teaches structuring data, understanding action results, and composing datapaths. This knowledge enhances automation by manipulating and accessing data effectively.
|
| Topic 13 | - Case Management and Workbooks: Case Management and Workbooks topic prepares Splunk analysts and administrators for managing complex security incidents using workbooks and marking evidence within the SOAR platform.
|