SIEM Core 2 Curriculum

Gain advanced, hands-on experience engineering SIEM environments at scale. Focus on forwarders, routing, deployment services, parsing, normalization, and syslog pipelines, culminating in an applied enterprise SIEM architecture project.

Engineering-Focused Guidance

Learn how SIEM platforms are engineered and operated in real-world environments. Concepts are taught from a data engineering and platform operations perspective, with clear explanations of how pipelines are designed, data is routed, normalized, and optimized for performance and reliability.

Enterprise SIEM Labs

Apply advanced concepts through hands-on labs focused on real SIEM engineering workflows. Build and manage ingestion pipelines, implement parsing and normalization logic, configure routing and deployment services, and validate designs through an enterprise-scale SIEM architecture project.

About the Course

TechForward SIEM Core 2 builds on the architectural foundation established in SIEM Core 1 by shifting focus from understanding how SIEM platforms work to engineering and operating them at scale. This course concentrates on the data engineering and operational layers that power real-world SIEM deployments. You’ll work hands-on with advanced ingestion pipelines, parsing and normalization logic, routing and deployment services, and syslog-based data flows to understand how security telemetry is engineered, managed, and optimized in enterprise environments. Emphasis is placed on designing reliable, scalable pipelines and understanding how data structure, routing decisions, and configuration choices impact performance and downstream analytics. Through guided, hands-on labs, you’ll implement and manage SIEM components as they would be used in production environments. This includes configuring forwarders and routing logic, building and validating parsing and normalization pipelines, and applying best practices for operating SIEM platforms at scale. The course culminates in an applied enterprise SIEM architecture project that brings these concepts together in a realistic end-to-end implementation. SIEM Core 2 is ideal for learners who have completed SIEM Core 1 or already possess a strong architectural understanding of SIEM platforms and want to specialize in SIEM engineering, data pipeline design, or enterprise-scale security analytics.

Meet Your Instructor,  Russell Oyewole, SIEM Consultant

Welcome — I’m Russell, a SIEM consultant who has spent years designing, implementing, and optimizing SIEM platforms across different organizations and environments. One of the most common challenges I see is that people are taught how to use SIEM tools, but not how the platform works beneath the surface. The TechForward SIEM-Ready Program was created to close that gap. In this course, you’ll learn how SIEM systems ingest data, normalize events, execute searches, and produce meaningful detections. My goal is to give you a clear, practical understanding of SIEM fundamentals so you can work confidently with security data and build reliable analytics in real-world environments.

SIEM Core 2 Curriculum

10 Chapters · 69 Lessons

  1. 1

    Domain 1 - Splunk Foundations & Architecture

    1. (Included in full purchase)

      Module 1 - What is Big Data? The 4 v's of big data?

    2. (Included in full purchase)

      Module 2 - What is Splunk? (Use cases, product overview)

    3. (Included in full purchase)

      Module 3 - Splunk components: Indexer, Search Head, Forwarders, Deployment Server, Heavy Forwarder

    4. (Included in full purchase)

      Module 4 - Indexing pipeline (Parsing, Indexing, Searching)

    5. (Included in full purchase)

      Module 5 - Licensing and deployment options

    6. (Included in full purchase)

      Module 6 - Demo: Install Splunk Enterprise on Linux

    7. (Included in full purchase)

      Module 7 - Understanding the Splunk Application

    8. (Included in full purchase)

      Module 8 - Upgrading Splunk

    9. (Included in full purchase)

      Module 9 - Demo: Upgrading Splunk Enterprise on Linux

    10. (Included in full purchase)

      Module 10 - Introduction to Splunk Search Interface

  2. 2

    Domain 2 - Search Fundamentals for Administrators

    1. (Included in full purchase)

      Module 1 - Basic Search Syntax

    2. (Included in full purchase)

      Module 2 - Essential Search Commands

    3. (Included in full purchase)

      Module 3 - Working with Time and Fields

    4. (Included in full purchase)

      Module - Lab - Validate Data Ingestion with Search

  3. 3

    Domain 3 - Data Ingestion & Indexing Pipeline

    1. (Included in full purchase)

      Writing Automated Tests

    2. (Included in full purchase)

      Module 1 - Inputs overview: Monitor, TCP/UDP, Scripted

    3. (Included in full purchase)

      Module 2 - Data flow: Parsing queue to Indexing queue

    4. (Included in full purchase)

      Module 3 - Index-time vs Search-time operations

    5. (Included in full purchase)

      Module 4 - Bucket types, structure, and retention

    6. (Included in full purchase)

      Module 5 - Configuring inputs.conf and indexes.conf

    7. (Included in full purchase)

      Module 6 - Hands-on: Ingest sample logs and verify indexing

  4. 4

    Domain 4 - Forwarders, Routing & Deployment Server

    1. (Included in full purchase)

      Module 1 - Universal Forwarder vs Heavy Forwarder

    2. (Included in full purchase)

      Module 2 - Installing and configuring forwarders

    3. (Included in full purchase)

      Module 3 - outputs.conf: routing to indexers or HFs

    4. (Included in full purchase)

      Module 4 - Configuring Deployment Server (serverclass.conf)

    5. (Included in full purchase)

      Module 5 - Best practices for forwarder management

    6. (Included in full purchase)

      Module 6 - Lab: Manage multiple forwarders with Deployment Server

  5. 5

    Domain 5 - Data Parsing, Normalization & Syslog Pipelines

    1. (Included in full purchase)

      Module 1 - props.conf overview: LINE_BREAKER, TIME_PREFIX, etc.

    2. (Included in full purchase)

      Module 2 - Timestamp extraction, event breaking

    3. (Included in full purchase)

      Module 3 - transforms.conf: field extractions, routing, masking

    4. (Included in full purchase)

      Module 4 - Index-time vs Search-time field extraction

    5. (Included in full purchase)

      Module 5 - Best practices for onboarding structured/unstructured logs

    6. (Included in full purchase)

      Module 6 - Lab: Mask and route logs using transforms

    7. (Included in full purchase)

      Module 7 - Syslog, syslog-ng, and rsyslog for log ingestion

  6. 6

    Domain 6 - Splunk Security, Authentication & Encryption

    1. (Included in full purchase)

      Module 1 - Security & Authentication

    2. (Included in full purchase)

      Module 2 - Role-based access control (authorize.conf)

    3. (Included in full purchase)

      Module 3 - Enabling and configuring TLS/SSL

    4. (Included in full purchase)

      Module 4 - Secure communication: Forwarders to Indexers

    5. (Included in full purchase)

      Module 5 - Lab: Implement TLS and configure secure roles

  7. 7

    Domain 7 - Distributed Architecture & Clustering

    1. (Included in full purchase)

      Module 1 - Distributed Search

    2. (Included in full purchase)

      Module 2 - Search Head and Search Peer setup

    3. (Included in full purchase)

      Module 3 - Search bundles and knowledge object replication

    4. (Included in full purchase)

      Module 4 - KV Store: use cases and configuration

    5. (Included in full purchase)

      Module 5 - Lab: Connect multiple indexers to a search head

    6. (Included in full purchase)

      Module 6 - Indexer Clustering - What is indexer clustering? When to use it

    7. (Included in full purchase)

      Module 7 - Cluster Master, Peer Nodes, and Search Heads

    8. (Included in full purchase)

      Module 8 - Replication Factor (RF) and Search Factor (SF)

    9. (Included in full purchase)

      Module 9 - Bucket replication and failure recovery

    10. (Included in full purchase)

      Module 10 - Configuration files: server.conf, indexes.conf

    11. (Included in full purchase)

      Module 11 - Lab: Deploy a 3-node indexer cluster

    12. (Included in full purchase)

      Module 12 - Search Head Clustering - Overview of Search Head Clustering

    13. (Included in full purchase)

      Module 13 - Deployer configuration and app bundling

    14. (Included in full purchase)

      Module 14 - Cluster members communication and state sync

    15. (Included in full purchase)

      Module 15 - Troubleshooting SHC replication and conflicts

    16. (Included in full purchase)

      Module 16 - Lab: Set up a 3-node Search Head Cluster with Deployer

  8. 8

    Domain 8 - Advanced Search & Development

    1. (Included in full purchase)

      Module 1 - Components of the Search Head

    2. (Included in full purchase)

      Module 2 - SPL (Search Processing Language)

    3. (Included in full purchase)

      Module 3 - CIM (Common Information Model)

    4. (Included in full purchase)

      Module 4 - Building Production Splunk Apps

  9. 9

    Domain 9 - Final Splunk Enterprise Architecture Project 1

    1. (Included in full purchase)

      Module 1 - Final Capstone Project 1 - Design Core Splunk Backend Architecture (Domains 1, 2, 3, 6)

    2. (Included in full purchase)

      Module 2 - Implement core Splunk roles (Domains 1, 2, 3, 6)

    3. (Included in full purchase)

      Module 3 - Implement ingestion & routing using core configs (Domains 2 & 3)

    4. (Included in full purchase)

      Module 4 - Validate distributed search, clustering, and data flow (Domain 6)

    5. (Included in full purchase)

      Module 5 - Document and present architecture

  10. 10

    Domain 10 - Final Splunk Enterprise Architecture Project 2

    1. (Included in full purchase)

      Module 1 - Final Capstone Project 2 - Refine & extend architecture (Domains 1, 2, 3, 6)

    2. (Included in full purchase)

      Module 2 - Implement full parsing & normalization pipeline (Domain 4)

    3. (Included in full purchase)

      Module 3 - Implement security, authentication & TLS (Domain 5)

    4. (Included in full purchase)

      Module 4 - End-to-end validation: data, clustering, security (Domains 2, 4, 5, 6)

    5. (Included in full purchase)

      Module 5 - Final presentation & documentation (Domains 1–6)

Student Testimonials

Discover how our course has transformed the testing skills and careers of our students.

”
Text-only testimonials are quick to scan and can highlight the value of your product at a glance.
Jessica L.

Las Vegas, NV

The combination of text and imagery make the testimonial feel more personal and credible.
Ashley T.

Working mom

”
Finally, a handbook that makes photography feel simple! It covers everything from camera settings to post-processing in a way that actually makes sense.
Anna W.

Amateur photographer

Ready to Advance into SIEM Engineering?

Hands-on training focused on data pipelines, scale, and enterprise SIEM implementation.

Please contact us for access. (opens email in new window)