SPLUNKSplunk Certified Cybersecurity Defense Engineer
The Splunk Certified Cybersecurity Defense Engineer certification validates your ability to optimize SOC workflows using Splunk Enterprise Security and Splunk SOAR. You'll learn to craft and tune effective detections, incorporate threat intelligence, and build automations that follow industry best practices. This credential is for security professionals ready to advance from analyst to defense engineering roles.
512 practice questions · Updated 2026-07-30
5Domains
19Objectives
140Concepts
512Questions
CYBERSECURITY-DEFENSE-ENGINEER Curriculum
Every domain, objective, and concept the CYBERSECURITY-DEFENSE-ENGINEER exam measures.
- Data Review Process
- Data Analysis Techniques
- Data Quality Assessment
- Data Correlation
- Data Visualization
- Data Enrichment
- Data Filtering and Reduction
- Data Validation
- Data Interpretation
- Data Documentation
- Indexing Performance Fundamentals
- Index Design and Configuration
- Data Input Management
- Indexer Clustering
- Monitoring and Troubleshooting Indexing
- Index Maintenance Tasks
- Performance Tuning Techniques
- Splunk Common Information Model (CIM)
- CIM Data Models
- Field Normalization Techniques
- Event Tagging for Normalization
- CIM Compliance Validation
- Custom Data Model Extensions
- Correlation Search Fundamentals
- Detection Logic Design
- Thresholds and Baselines
- Tuning for False Positives
- Testing and Validation
- Performance Optimization
- Documentation and Maintenance
- Contextual Data Sources
- Context Enrichment Techniques
- Correlation Search Design
- Contextual Thresholds and Anomalies
- Contextual Alerting and Response
- Risk-based modifier fundamentals
- Risk score and risk object concepts
- Creating risk-based modifiers
- Applying risk-based modifiers to detections
- Risk-based detection tuning
- Testing and validating risk-based detections
- Notable Event Generation
- Correlation Searches
- Notable Event Attributes
- Notable Event Actions
- Notable Event Suppression
- Notable Event Throttling
- Notable Event Enrichment
- Notable Event Review Workflow
- Notable Event Tuning
- Notable Event Testing and Validation
- Detection lifecycle phases
- Detection requirements gathering
- Detection development process
- Detection deployment and integration
- Detection monitoring and tuning
- Detection retirement and review
- Threat Intelligence Sources
- Threat Intelligence Collection Methods
- Threat Intelligence Evaluation
- Threat Intelligence Integration
- Threat Intelligence Development
- Threat Intelligence Dissemination
- Risk Assessment Frameworks
- Threat Modeling
- Asset Classification and Valuation
- Vulnerability Assessment
- Risk Scoring and Prioritization
- Detection Engineering Prioritization
- MITRE ATT&CK Framework
- Risk Treatment and Mitigation
- Continuous Monitoring and Review
- Documentation Standards
- SOP Structure
- Process Documentation
- Procedure Writing
- Version Control
- Audience Consideration
- Review and Approval Workflow
- Maintenance and Updates
- SOP Automation Workflow Design
- Orchestration Tool Integration
- Playbook Development
- API and Webhook Utilization
- Conditional Logic and Decision Trees
- Error Handling and Retry Mechanisms
- Security and Access Control in Automation
- Testing and Validation of Automation
- Monitoring and Logging Automation
- Documentation and Maintenance of SOPs
- Case Lifecycle Management
- Case Assignment and Ownership
- Case Prioritization and Triage
- Case Collaboration and Communication
- Case Automation Workflows
- Case Metrics and Reporting
- Case Integration with SOAR
- Case Data Enrichment
- Case Audit and Compliance
- REST API Fundamentals
- Authentication for Splunk REST API
- Common Splunk REST API Endpoints
- Making REST API Calls
- Handling API Responses
- Automating Tasks with REST API
- SOAR playbook fundamentals
- Playbook triggers and inputs
- Playbook actions and logic
- Integration with security tools
- Playbook testing and debugging
- Playbook versioning and management
- Playbook performance and optimization
- Integration capabilities of Enterprise Security
- Integration capabilities of SOAR
- Automation capabilities of Enterprise Security
- Automation capabilities of SOAR
- Comparison of integration approaches
- Comparison of automation approaches
- Validation of integration and automation capabilities
- Define security metrics
- Select relevant metrics
- Develop metrics from data sources
- Establish baselines and targets
- Optimize metrics for actionability
- Visualize and report metrics
- Review and improve metrics
- Security report structure
- Data sources for reports
- Report generation techniques
- Report scheduling and distribution
- Report validation and accuracy
- Dashboard design principles
- Dashboard creation in Splunk
- Dashboard population with search results
- Dashboard data sources and indexes
- Dashboard visualization types
- Dashboard interactivity and drilldowns
- Dashboard sharing and permissions
- Dashboard performance optimization
- Dashboard maintenance and lifecycle
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CYBERSECURITY-DEFENSE-ENGINEER, so none is invented.