Lion Cipher Lab
Set up Splunk Free on your own lab
- SOC Analyst / Blue Team
- Beginner
- ~40 min
- Free · no account required
Why it matters
SIEM stands for Security Information and Event Management: one system that collects logs and events from across an environment into a single searchable place, so you can hunt, correlate, alert, and report on them instead of chasing one machine at a time. Splunk is the SIEM a new analyst is most likely to sit in front of on the job, and getting data into it is the skill every shift is built on. Splunk Free lets you learn the real product on your own lab for nothing, and doing the install-to-first-event loop once turns Splunk from an intimidating enterprise tool into a box you own and…
What you'll learn
- what a SIEM is and where Splunk fits
- the Splunk index -> search -> dashboards pipeline
- what Splunk Free allows and its limits (500 MB/day, no auth, no alerting)
- installing Splunk via the Docker image or the free download
- logging in to Splunk Web
- creating an index and choosing a sourcetype
- uploading a sample log file and confirming indexed events
Steps in this lab
- What Splunk is, in one breath
- What Splunk Free gives you, and what it does not
- Install it — Docker (fastest) or the free download
- Log in to Splunk Web
- Make an index for your data
- Add data: upload your sample log file
- Confirm you can see your events
- Where this fits, and what to do next