thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Splunk Enterprise Security (ES)

Splunk's premium SIEM application providing correlation searches, notable events, risk-based alerting and security dashboards.

Definition

Splunk ES builds on CIM-normalized data to deliver correlation searches, incident review, asset and identity correlation, threat intelligence management and risk-based alerting. ES 8 integrates investigation and SOAR capabilities into a unified analyst workflow. It is Splunk's flagship security product.

Example

Analysts working the Incident Review dashboard to triage notable events.

Exam tip

ES requires CIM-compliant data and accelerated data models.

Related terms