Day 1
Splunk foundations & architecture
New: Capsule Courses • Job-ready skills in under a week | +1 (646) 980-6267
● CAPSULE COURSE6 DAYS
Splunk
A focused, instructor-led sprint on Microsoft Sentinel. Connect real data sources, write KQL detections, investigate incidents and automate response with playbooks, all inside your own lab workspace. Built for SOC analysts and security engineers who need production-ready Sentinel skills fast.
6 days
Mon-Sat
15 hrs
Live, instructor-led
6 labs
Hands-on Project
Splunk . CAPSULE
Original price was: $249.00.$159.00Current price is: $159.00.
One-rime fee . full 6- day capsule
Sessions 7:00 - 9:30 PM EST . Mon - Sat
- 6 live sessions with a Splunk practitioner
- Dedicated Splunk Enterprise lab
- Session recordings with lifetime access
- Lab guides and SPL query pack
- Capstone review by the instructor
- Certificate of completion
WHAT IS A
CAPSULE COURSE?
CAPSULE COURSE?
5–7 days, one skill
A short live sprint on a single tool, taught to the depth employers expect.
Labs every day
Each session ends with a guided lab in your own environment.
Stackable
Combine capsules or credit the fee toward a full Job Seeker's Package.
SIX DAYS AT A GLANCE
From empty workspace to
automated SOC in one week
Who this capsule is for
- SOC analysts working with or moving to Splunk
- IT operations and system administrators handling log data
- Security engineers building detections and dashboards
- Learners preparing for SPLK-1001 or SPLK-1002
- Career switchers moving into SOC or security analytics roles
Before you start
- Basic understanding of networking and security concepts
- Familiarity with the Azure portal
- A laptop with a modern browser and stable internet
- 2.5 hours each evening for six days
We provide a lab subscription for the six days. No personal credit card or paid account needed.
DAY-BY-DAY PLAN
MS Sentinel Capsule Curriculum
Day 1:Splunk foundations & architecture
- What Splunk does and where it fits in a SOC
- Components: indexes, search heads, forwarders
- Indexes, buckets and data retention
- Navigating Search & Reporting
- Hands-on Lab Log in to your Splunk lab, explore indexes and run your first searches
Day 2:Getting data in
- Universal Forwarder setup and inputs
- Windows event logs, Linux syslog and web logs
- Source types, timestamps and line breaking
- Validating ingestion and troubleshooting
- Hands-on Lab: Onboard Windows, Linux and web server logs and validate the data
Day 3:Search Processing Language (SPL)
- Search basics: time ranges, filters and fields
- Commands: stats, table, eval, rex, top, rare
- Transactions, subsearches and joins
- Search best practice and performance
- Hands-on Lab: Write 10 Investigation searches against authentication and web data
Day 4:Knowledge objects
- Field extractions and calculated fields
- Lookups, tags and event types
- Macros and saved searches
- Data models and the Common Information Model (CIM)
- Hands-on Lab: Build lookups and field extractions, then map data to the CIM
Day 5:Dashboards, reports & alerts
- Reports and scheduled searches
- Dashboard Studio: panels, inputs and drilldowns
- Alert conditions, throttling and actions
- Detections mapped to MITRE ATT&CK
- Hands-on Lab: Build a SOC dashboard and alerts for brute force and suspicious logins
Day 6:Enterprise Security & capstone
- Splunk Enterprise Security overview
- Notable events, correlation searches and risk-based alerting
- Incident review and investigation workflow
- Hands-on Lab: Capstone: investigate a simulated attack end to end
OUTCOMES
By the end of Day 6
you will be able to
Navigate Splunk and understand its architecture
Onboard data with forwarders, inputs and source types
Write SPL searches for hunting and investigation
Build reports, dashboards and scheduled alerts
Use field extractions, lookups and data models
Investigate notable events in Splunk Enterprise Security
TOOLS & SKILLS
What you will work with
Alerts
CIM
Dashboards
Data Models
Enterprise Security
Field Extractions
Lookups
MITRE ATT&CK
Source Types
SPL
Splunk Enterprise
Universal Forwarder
PICK YOUR PATH
Capsule or full program?
MS Sentinel
Original price was: $249.00.$159.00Current price is: $159.00.
- Online Live Training
- In-Depth Learning
- 6 Days, 15 hrs live
- Certificate of completion
Job seeker's package
Original price was: $249.00.$159.00Current price is: $159.00.
- Online Live Training
- In-Depth Learning
- 6 Days, 15 hrs live
- Certificate of completion
Completed the capsule? Your $159 is credited toward the Job Seeker’s Package if you upgrade within 30 days.
Our Students Work at
Motivation for Thinkcloudly
★★★★★ 5/5 average learner rating
FAQ'S
Capsule FAQs
Still deciding? Our advisors answer enrollment questions seven days a week.
Capsules cover one tool or skill in depth over 5 to 7 days of live sessions. You get the same instructors and lab quality as our full programs, in a shorter and more affordable format.
All six live sessions, session recordings, a dedicated Splunk lab, lab guides, the capstone review and a ThinkCloudly certificate of completion.
No. We provide a Splunk Enterprise lab with sample security data for the duration of the capsule.
No. Day 1 starts from the basics. A general understanding of networking and logs will help you move faster.
Yes. Every session is recorded and available in the LMS the same night, and you can join the matching day in the next cohort at no extra cost.
The capsule covers the core topics of SPLK-1001 (Core Certified User) and SPLK-1002 (Core Certified Power User) with hands-on practice.
We accept all major credit and debit cards from leading banks. For any assistance, please contact ThinkCloudly Customer Support.
