FirstTry

Certification guide

Cybersecurity Defense Engineer

Splunk Certified Cybersecurity Defense Engineer: the honest guide

The Splunk Certified Cybersecurity Defense Engineer is 60 multiple choice questions in 75 minutes, closed book, at Pearson VUE for $130 an attempt, with no prerequisite certification. Splunk rates it professional and writes the track page for Cybersecurity Defense Analysts growing into detection engineering, using Splunk Enterprise Security and Splunk SOAR.

The blueprint is five areas. Detection Engineering is 40 percent, Building Effective Security Processes and Programs and Automation and Efficiency are 20 percent each, and Data Engineering and Auditing and Reporting on Security Programs are 10 percent each.

Nearly half the exam is one area. Writing, tuning and maintaining detections in Enterprise Security is the job the certification describes, and the automation area is SOAR.

Who Cybersecurity Defense Engineer is for

A good fit if

  • You write and tune detections in Splunk Enterprise Security and want the certification Splunk names for detection engineers.
  • You are a Defense Analyst moving from working notables to building the content that produces them, which is the person the track page describes.
  • You build SOAR playbooks and want the automation area credited alongside the detection work.

Probably not, if

  • You do not have access to Enterprise Security and SOAR. Neither is part of the free Splunk Enterprise license, and 60 percent of the blueprint is hands on work in them.
  • You are still learning to investigate. The Defense Analyst covers that ground, and Splunk positions the Engineer as the step after it.
  • You want an exam that renews your Analyst. The handbook lists no link between the three Cybersecurity Defense certifications.

Is Cybersecurity Defense Engineer worth it?

For a detection engineer on Splunk it is $130, needs no prerequisite certification, and the free detection engineering and SOAR courses cover the theory.

Its value is tied to Enterprise Security and SOAR being your tools. The processes and auditing areas transfer, but the 60 percent that is detection and automation is product specific.

Renewal is a $130 retake every three years with no next level option, so hold it for the role rather than as a step towards the Architect, which does not renew it either.

What the exam actually asks you to do

60 multiple choice questions and nothing else. Splunk sets no lab and no simulation on this exam, so the practice that matters is reading a scenario and choosing well under the clock.

Item formats

  • Multiple choice

Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. Splunk, Splunk Certified Cybersecurity Defense Engineer certification track ↗

Domain breakdown and official weightings

From the official Splunk certification tracks. Detection Engineering is the heaviest domain at 40 percent, followed by Building Effective Security Processes and Programs at 20 percent.

  • Data Engineering10%
  • Detection Engineering40%
  • Building Effective Security Processes and Programs20%
  • Automation and Efficiency20%
  • Auditing and Reporting on Security Programs10%

Where to focus: Detection Engineering alone is 40% of the exam, which is 24 of the 60 questions. Automation and Efficiency and Building Effective Security Processes are 20% each, so three sections carry 80% of the paper.

Splunk: Splunk certification tracks ↗

Study plans by experience level

Detection engineer on ES and SOAR today

4 to 6 weeksat 4 to 6 hours

  1. 1Read the blueprint and mark the areas outside your daily work, usually security processes and programs and auditing and reporting, which are 30 percent together.
  2. 2Work through Introduction to Detection Engineering with Splunk and Splunk Security Use Case Development: Using ESCU and Security Essentials from the free training page to check your practice against Splunk's framing.
  3. 3Review your own detection lifecycle, from data onboarding through tuning and risk to reporting, against the blueprint and write down where each step maps.
  4. 4Take timed practice sets and book once the flagged sections stop repeating.

Defense Analyst moving into engineering

8 to 10 weeksat 6 to 8 hours

  1. 1Start with the free Introduction to Detection Engineering with Splunk and Splunk Security Use Case Development courses, then build and tune a detection end to end in your work ES environment under change control.
  2. 2Do Introduction to Splunk SOAR, Implementing SOAR Community Playbooks and Developing SOAR Playbooks for Enterprise Security, building at least one playbook that acts on an ES notable.
  3. 3Cover Data Engineering on a free Splunk Enterprise license, onboarding a new security source to CIM compliance.
  4. 4Spend the final fortnight on processes, programs and auditing, using your own SOC's documents, then timed practice sets.

Detection engineer from another SIEM

6 to 8 weeksat 5 to 7 hours

  1. 1Learn the Splunk specific detection model first: correlation searches, risk based alerting, ESCU content and the tuning workflow, through the free detection engineering and use case development courses.
  2. 2Get hands on time in Enterprise Security and SOAR at work, porting two detections and one automation you already own.
  3. 3Onboard one data source to CIM on a free Splunk Enterprise license for the Data Engineering area.
  4. 4Take timed practice sets and book more than 48 hours out.

Common mistakes

Studying detection engineering as theory
At 40 percent it is the exam. The questions turn on how a correlation search, risk rule or ESCU detection behaves when tuned, and that is only learned by tuning one.
Leaving SOAR to the end
Automation and Efficiency is 20 percent and SOAR is its own product with its own playbook model. The free SOAR courses take time and need hands on follow up.
Skipping processes, programs and auditing
Thirty percent of the exam is the program around the detections: processes, reporting and audit. Engineers who only study content lose marks they could have had from reading their own SOC's runbooks.
Forgetting Data Engineering
It is 10 percent and it is where detections fail in practice. Onboard a source to CIM compliance yourself so the questions about field normalization are recall.
Opening the documentation
The exam is closed book and the handbook treats any reference material as an automatic failure with the fee forfeited.

What comes after passing

The Defense Architect is the expert level exam in the same family, with no prerequisite. It does not renew the Engineer, so plan both windows separately.

Put the renewal date in your own calendar. The handbook lists no next level option, so the Engineer renews only by a $130 retake in the final year of the three year window, with a 90 day grace period and no extensions.

Claim the Credly badge on a personal email address, as the handbook recommends.

Where people go next

Splunk Certified Cybersecurity Defense Architect

Costs across the full renewal cycle are on the Cybersecurity Defense Engineer cost page.

Frequently asked questions

Is the Defense Analyst required first?

No. The track page lists no prerequisite. Splunk writes the page for analysts growing into engineering, but the Analyst certification is not checked at registration.

Can I prepare without Enterprise Security and SOAR?

Only partly. The free courses cover the concepts, and a free Splunk Enterprise license covers the Data Engineering area, but 60 percent of the blueprint is detection and automation work that needs the products. Employer access is the realistic route.

Is there a passing score?

Splunk does not publish one. Pass or fail appears on submission, and a failing candidate sees section feedback in the Pearson VUE account.

How do I renew it?

By retaking the Engineer exam in the final year of the three year window. The handbook lists no next level option and no downstream certifications for it. There is a 90 day grace period and no extensions.

How is the exam weighted?

Detection Engineering is 40 percent, Building Effective Security Processes and Programs and Automation and Efficiency are 20 percent each, and Data Engineering and Auditing and Reporting on Security Programs are 10 percent each.

Keep reading

Every guide and cost breakdown, by vendor

Practice Cybersecurity Defense Engineer for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free Cybersecurity Defense Engineer questions