SIEM Core 1 Curriculum

Gain structured, hands-on understanding of how SIEM platforms are built and organized. Learn the foundational components of SIEM architecture, including search fundamentals, data ingestion and indexing, platform security, and distributed system design that underpin scalable SIEM environments.

Platform-Focused Guidance

Learn how SIEM platforms actually work under the hood. Concepts are taught from an architectural and platform perspective, with clear explanations of how searches execute, data is indexed, security controls are applied, and clustering enables scale and resilience.

Hands-On SIEM Labs

Apply core concepts through guided labs focused on platform behavior rather than advanced pipelines. Explore search mechanics, indexing behavior, architectural components, and distributed concepts to reinforce how SIEM systems operate in real environments.

About the Course

TechForward SIEM Core 1 is designed to establish a clear, architectural understanding of how modern SIEM platforms are built and operate. Rather than treating SIEM as a black box or a collection of dashboards, this course focuses on the foundational components that underpin SIEM systems—platform architecture, search fundamentals, data ingestion and indexing, security controls, and distributed design. You’ll explore how security data flows through a SIEM from ingestion to search and analysis, how indexing and search behavior affect performance and results, and how authentication, encryption, and clustering enable secure and scalable deployments. Emphasis is placed on understanding platform behavior and design decisions so you can reason about how and why SIEM systems behave the way they do. Through guided, hands-on labs, you’ll reinforce these concepts by working directly with SIEM components and workflows, focusing on architectural understanding rather than advanced pipeline engineering. This approach prepares you to move beyond surface-level usage and build a strong conceptual foundation for more advanced SIEM work. SIEM Core 1 is ideal for learners who already understand core systems and want to develop a solid SIEM foundation before progressing to advanced data pipelines, parsing, normalization, and enterprise-scale architecture in SIEM Core 2.

Meet Your Instructor,  Russell Oyewole, SIEM Consultant

Welcome — I’m Russell, a SIEM consultant who has spent years designing, implementing, and optimizing SIEM platforms across different organizations and environments. One of the most common challenges I see is that people are taught how to use SIEM tools, but not how the platform works beneath the surface. The TechForward SIEM-Ready Program was created to close that gap. In this course, you’ll learn how SIEM systems ingest data, normalize events, execute searches, and produce meaningful detections. My goal is to give you a clear, practical understanding of SIEM fundamentals so you can work confidently with security data and build reliable analytics in real-world environments.

SIEM Core 1 Curriculum

10 Chapters · 69 Lessons

  1. 1

    Domain 1 - Splunk Foundations & Architecture

    1. (Included in full purchase)

      Module 1 - What is Big Data? The 4 v's of big data?

    2. (Included in full purchase)

      Module 2 - What is Splunk? (Use cases, product overview)

    3. (Included in full purchase)

      Module 3 - Splunk components: Indexer, Search Head, Forwarders, Deployment Server, Heavy Forwarder

    4. (Included in full purchase)

      Module 4 - Indexing pipeline (Parsing, Indexing, Searching)

    5. (Included in full purchase)

      Module 5 - Licensing and deployment options

    6. (Included in full purchase)

      Module 6 - Demo: Install Splunk Enterprise on Linux

    7. (Included in full purchase)

      Module 7 - Understanding the Splunk Application

    8. (Included in full purchase)

      Module 8 - Upgrading Splunk

    9. (Included in full purchase)

      Module 9 - Demo: Upgrading Splunk Enterprise on Linux

    10. (Included in full purchase)

      Module 10 - Introduction to Splunk Search Interface

  2. 2

    Domain 2 - Search Fundamentals for Administrators

    1. (Included in full purchase)

      Module 1 - Basic Search Syntax

    2. (Included in full purchase)

      Module 2 - Essential Search Commands

    3. (Included in full purchase)

      Module 3 - Working with Time and Fields

    4. (Included in full purchase)

      Module - Lab - Validate Data Ingestion with Search

  3. 3

    Domain 3 - Data Ingestion & Indexing Pipeline

    1. (Included in full purchase)

      Writing Automated Tests

    2. (Included in full purchase)

      Module 1 - Inputs overview: Monitor, TCP/UDP, Scripted

    3. (Included in full purchase)

      Module 2 - Data flow: Parsing queue to Indexing queue

    4. (Included in full purchase)

      Module 3 - Index-time vs Search-time operations

    5. (Included in full purchase)

      Module 4 - Bucket types, structure, and retention

    6. (Included in full purchase)

      Module 5 - Configuring inputs.conf and indexes.conf

    7. (Included in full purchase)

      Module 6 - Hands-on: Ingest sample logs and verify indexing

  4. 4

    Domain 4 - Forwarders, Routing & Deployment Server

    1. (Included in full purchase)

      Module 1 - Universal Forwarder vs Heavy Forwarder

    2. (Included in full purchase)

      Module 2 - Installing and configuring forwarders

    3. (Included in full purchase)

      Module 3 - outputs.conf: routing to indexers or HFs

    4. (Included in full purchase)

      Module 4 - Configuring Deployment Server (serverclass.conf)

    5. (Included in full purchase)

      Module 5 - Best practices for forwarder management

    6. (Included in full purchase)

      Module 6 - Lab: Manage multiple forwarders with Deployment Server

  5. 5

    Domain 5 - Data Parsing, Normalization & Syslog Pipelines

    1. (Included in full purchase)

      Module 1 - props.conf overview: LINE_BREAKER, TIME_PREFIX, etc.

    2. (Included in full purchase)

      Module 2 - Timestamp extraction, event breaking

    3. (Included in full purchase)

      Module 3 - transforms.conf: field extractions, routing, masking

    4. (Included in full purchase)

      Module 4 - Index-time vs Search-time field extraction

    5. (Included in full purchase)

      Module 5 - Best practices for onboarding structured/unstructured logs

    6. (Included in full purchase)

      Module 6 - Lab: Mask and route logs using transforms

    7. (Included in full purchase)

      Module 7 - Syslog, syslog-ng, and rsyslog for log ingestion

  6. 6

    Domain 6 - Splunk Security, Authentication & Encryption

    1. (Included in full purchase)

      Module 1 - Security & Authentication

    2. (Included in full purchase)

      Module 2 - Role-based access control (authorize.conf)

    3. (Included in full purchase)

      Module 3 - Enabling and configuring TLS/SSL

    4. (Included in full purchase)

      Module 4 - Secure communication: Forwarders to Indexers

    5. (Included in full purchase)

      Module 5 - Lab: Implement TLS and configure secure roles

  7. 7

    Domain 7 - Distributed Architecture & Clustering

    1. (Included in full purchase)

      Module 1 - Distributed Search

    2. (Included in full purchase)

      Module 2 - Search Head and Search Peer setup

    3. (Included in full purchase)

      Module 3 - Search bundles and knowledge object replication

    4. (Included in full purchase)

      Module 4 - KV Store: use cases and configuration

    5. (Included in full purchase)

      Module 5 - Lab: Connect multiple indexers to a search head

    6. (Included in full purchase)

      Module 6 - Indexer Clustering - What is indexer clustering? When to use it

    7. (Included in full purchase)

      Module 7 - Cluster Master, Peer Nodes, and Search Heads

    8. (Included in full purchase)

      Module 8 - Replication Factor (RF) and Search Factor (SF)

    9. (Included in full purchase)

      Module 9 - Bucket replication and failure recovery

    10. (Included in full purchase)

      Module 10 - Configuration files: server.conf, indexes.conf

    11. (Included in full purchase)

      Module 11 - Lab: Deploy a 3-node indexer cluster

    12. (Included in full purchase)

      Module 12 - Search Head Clustering - Overview of Search Head Clustering

    13. (Included in full purchase)

      Module 13 - Deployer configuration and app bundling

    14. (Included in full purchase)

      Module 14 - Cluster members communication and state sync

    15. (Included in full purchase)

      Module 15 - Troubleshooting SHC replication and conflicts

    16. (Included in full purchase)

      Module 16 - Lab: Set up a 3-node Search Head Cluster with Deployer

  8. 8

    Domain 8 - Advanced Search & Development

    1. (Included in full purchase)

      Module 1 - Components of the Search Head

    2. (Included in full purchase)

      Module 2 - SPL (Search Processing Language)

    3. (Included in full purchase)

      Module 3 - CIM (Common Information Model)

    4. (Included in full purchase)

      Module 4 - Building Production Splunk Apps

  9. 9

    Domain 9 - Final Splunk Enterprise Architecture Project 1

    1. (Included in full purchase)

      Module 1 - Final Capstone Project 1 - Design Core Splunk Backend Architecture (Domains 1, 2, 3, 6)

    2. (Included in full purchase)

      Module 2 - Implement core Splunk roles (Domains 1, 2, 3, 6)

    3. (Included in full purchase)

      Module 3 - Implement ingestion & routing using core configs (Domains 2 & 3)

    4. (Included in full purchase)

      Module 4 - Validate distributed search, clustering, and data flow (Domain 6)

    5. (Included in full purchase)

      Module 5 - Document and present architecture

  10. 10

    Domain 10 - Final Splunk Enterprise Architecture Project 2

    1. (Included in full purchase)

      Module 1 - Final Capstone Project 2 - Refine & extend architecture (Domains 1, 2, 3, 6)

    2. (Included in full purchase)

      Module 2 - Implement full parsing & normalization pipeline (Domain 4)

    3. (Included in full purchase)

      Module 3 - Implement security, authentication & TLS (Domain 5)

    4. (Included in full purchase)

      Module 4 - End-to-end validation: data, clustering, security (Domains 2, 4, 5, 6)

    5. (Included in full purchase)

      Module 5 - Final presentation & documentation (Domains 1–6)

Student Testimonials

Discover how our course has transformed the testing skills and careers of our students.

”
Text-only testimonials are quick to scan and can highlight the value of your product at a glance.
Jessica L.

Las Vegas, NV

The combination of text and imagery make the testimonial feel more personal and credible.
Ashley T.

Working mom

”
Finally, a handbook that makes photography feel simple! It covers everything from camera settings to post-processing in a way that actually makes sense.
Anna W.

Amateur photographer

Ready to Understand How SIEM Platforms Really Work?

Develop a strong architectural foundation by learning how SIEM platforms ingest data, execute searches, apply security controls, and scale through distributed design.

Please contact us for access. (opens email in new window)