Designing a Multi-Site Splunk Architecture for a Global Enterprise

Design a highly available and scalable Splunk deployment architecture to support a multinational organization's security operations across multiple geographic regions. Incorporate indexer clustering, search head clustering, disaster recovery planning, capacity sizing, and license management while ensuring seamless data ingestion and CIM-compliant normalization.

Building an Advanced Threat Detection Portfolio Mapped to MITRE ATT&CK

Develop a comprehensive library of detection use cases covering multiple MITRE ATT&CK tactics and techniques using Splunk Enterprise Security correlation searches, behavioral analytics, and machine learning toolkit models. Integrate threat intelligence feeds and tune detection rules to reduce false positives and minimize alert fatigue across the SOC.

Automating Incident Response with Splunk SOAR Playbooks

Design and implement automated incident response playbooks in Splunk SOAR that handle phishing triage, malware containment, and suspicious login investigation workflows. Integrate the playbooks with ticketing systems and threat intelligence platforms, and build executive dashboards measuring SOC performance metrics such as MTTR, MTTD, and analyst workload.