SOC Tools Landscape
Every tool in the modern SOC stack — and why Splunk sits at the centre
Learning Objectives
- ›Map the modern SOC technology stack
- ›Differentiate SIEM, EDR, NDR, SOAR, TIP, vulnerability management
- ›Understand integration patterns (API, syslog, agent, webhook)
- ›Know where Splunk Enterprise Security fits
Module 1 — SIEM — The Brain
Security Information & Event Management. Ingests, normalizes, correlates, alerts on logs from every source.
Industry leaders: Splunk Enterprise Security, Microsoft Sentinel, IBM QRadar, Google Chronicle, Elastic Security.
Splunk ES is the most-deployed enterprise SIEM and the focus of this course.
Module 2 — EDR — The Eyes on the Endpoint
Endpoint Detection & Response. Records every process, network connection, file write on hosts.
Leaders: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Carbon Black.
EDR alerts and telemetry feed directly into Splunk for correlation.
Module 3 — NDR — The Network Recorder
Network Detection & Response. Inspects east-west and north-south traffic for anomalies.
Tools: Zeek (open source), Corelight, Darktrace, ExtraHop, Suricata (IDS/IPS).
Module 4 — Email Security & Identity
Email gateway: Proofpoint, Mimecast, Microsoft Defender for O365 — phishing is still the #1 initial access vector.
Identity: Okta, Azure AD/Entra ID, Ping, Duo — sign-in logs, MFA, conditional access.
Module 5 — SOAR — The Hands
Security Orchestration, Automation & Response. Codifies analyst workflows into playbooks.
Leaders: Splunk SOAR (Phantom), Palo Alto Cortex XSOAR, Microsoft Sentinel Logic Apps.
Typical actions: enrich IP, lookup user, disable account, isolate host, block at firewall.
Module 6 — TIP & Vulnerability Mgmt
Threat Intel Platform: MISP, Anomali, Recorded Future — feeds Splunk's threat intel framework.
Vulnerability Management: Tenable, Qualys, Rapid7 — feeds asset criticality and patch context.
Module 7 — How Tools Talk to Splunk
Universal Forwarder (lightweight Splunk agent on every host)
Syslog (network devices, firewalls)
API pull (cloud, SaaS — Okta, AWS, O365)
HTTP Event Collector / HEC (custom apps, webhooks)
Lab 3 — Design Your Stack
- For a 5,000-employee fintech, list every tool category needed.
- Pick a specific product per category (SIEM, EDR, NDR, SOAR, TIP, Email, Identity, VM).
- Sketch the data flow: which tools send to Splunk, and how (agent / syslog / API / HEC).
- Identify the 10 highest-value log sources to onboard first.
Key Takeaways
- ✓SIEM is the brain; everything else feeds it
- ✓Splunk integrates via UF, syslog, API, and HEC
- ✓EDR + Identity + Email is the modern detection trifecta