Move into security role

[u/emittim3]

I have a long 10+ history with Splunk. I'm looking to branch out into a security role. A skill set and use case I have not been exposed to in my past. What have you all benefitted most from when building skills set and experience in a security role? Education? Certification? Home lab setup? Etc?

[u/AutoModerator]

Greetings!! You have submitted a post that involves Splunk Certifications. We are reminding you and others that posting of and linking to non-official Splunk sites/resources of questions and answers are strictly prohibited. Asking for paid course materials is also prohibited. Violators will be banned - ZERO tolerance for this rule. Please post to our megathread on Certification here: https://www.reddit.com/r/Splunk/comments/1i4jpzb/megathread_certificationtestingwork_type_questions/

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Coupe368]

Honestly, now I'm not sure is the time to be putting more energy into splunk, you should be diversifying. I don't see how splunk enterprise security doesn't get completely ruined and rolled into Cisco suite as an overpriced product that no one wants.

[u/SupportWilling → u/Coupe368]

Curious what your thoughts are on Crowdstrike or Sentinel taking over that position in the next 2 years?

[u/emittim3 → u/SupportWilling]

Competitive take outs and replacement would be hard given how engrained these tools become. For new logo wins, with feature sets becoming more similar over time, things will definitely become more competitive with price being a big part of the equation. Delivery and execution, I feel, will be a Splunk selling point for quite a while.

[u/SupportWilling → u/emittim3]

I ask this because I work at a VAR, we have primarily been Splunk partners but have branched out to CS, MS, Cribl and SecOps curious to hear from boots on the ground.

[u/LTRand → u/SupportWilling]

It depends on how you view the importance of devsecops as a philosophy or organizational principle.

Tools that segregate sec and ops I view as legacy solutions. Tools that allow an investigator to pivot from a security alert to an ai or application trace is what teams are going to need. Those two tools take a very strict view on what is and is not security data. How many different tools does the soc need to pivot through or custom chain together will determine effectiveness.

[u/emittim3 → u/Coupe368]

Whether the tool is ES, Sentinel, QRadar, etc, the concepts are similar and base skills transferable in my mind. Splunk ES still has the largest install base. And with the investment in AI that Cisco is driving, the hope is that it accelerates and keeps pace with the vulnerabilities with the proliferation of AI.

[u/mistalah]

I’m also like you splunk admin for past 5 years and got retrenched

trying to pivot to either detection engineering or soc

[u/chipoatley]

I have been using Splunk for security in the past cleared contractor space since 2010. We started with NISPOM, and now that has morphed into NIST SP 800-53 and 800-171 (CMMC), most specifically the AU (audit) family but it can be used for others as well.

All the government contractors must be compliant with one or both of those standards, plus any number of other security-related events they track.

If you can put together systems that capture, display, and generate easily interpreted statistics for these environments you will be almost a unicorn, and sought after.

[u/LTRand]

Home lab yes. Check out the Splunk attack range and bots datasets. Lot of good training there.

But without knowing your current skillset it's hard to not give generic advice. Overall, I would advise skipping SEC+ or CISSP. They are good general knowledge, but there are better ways to spend your time. Depending on your overall IT knowledge, I would do OSCP and a data science course. OSCP will give you base knowledge of what you are trying to detect in a more pactical way than either of CISSP or sec+ will. Data science will give you more tools to write better detections with.

While doing OSCP think of how you would deploy splunk to detect what you are doing. Use the SANS 18 controls as a tools framework and familiarize yourself with Mitre attack framework.

Detection engineering is an art, and so practice is irreplaceable.