Here are a few questions from the session (get the full Q&A deck and live recording in the #office-hours Slack channel)

Q1: How can one hone threat detection skills by setting up projects for threat detection and incident response at home? What are the recommended steps? 

• Previous BOTS have their data out on github (i.e. https://github.com/splunk/botsv3) that can be used for this purpose.

• Alternatively, on the BOTS site (https://bots.splunk.com) there are multiple self-paced scenarios for learning where you can learn as well.

• Defcon Blue Team Village recordings https://www.youtube.com/watch?v=-upNhwmNGp8&list=PL9fPq3eQfaaDdj_DjG61x9Iz9O8mfC4mJ

• Read up on the PEAK framework https://www.splunk.com/en_us/blog/security/peak-threat-hunting-framework.html

• If you work in a SOC ask for 5%

Q2: What is the best practice of Data Parsing?

• For field breakouts, if the data is formatted (CSV,etc), utilizing the built-in parsers is really the “easy button” here.
• When working with custom fields or data, having a firm grasp of regular expressions (regex) to parse the data is a must.
• Field/character offsets are too non-deterministic to be considered a best practice, but can be utilized in quick and dirty methods.
  
• “Logging best practices in an app or add-on for Splunk Enterprise”
  https://dev.splunk.com/view/logging-best-practices/SP-CAAADP6

Q3: Can we create ML used queries in correlation search alerting? How to incorporate ML based threat hunting using Splunk?

• Do you need a model or just a dynamic threshold?
• Depending on the ML in use, a baseline or model will need to be created and from that queries can be run to do analysis against the model itself.  
• Enterprise Security has multiple pieces of content (Correlation Searches, etc) based on ML approaches.
• ML Toolkit
• Splunk Security Essentials
• Threat Hunting with ML can be done
• https://www.splunk.com/en_us/blog/security/peak-framework-math-model-assisted-threat-hunting.html

Other Questions (check the #office-hours Slack channel for responses):

• Could you talk about tablos in ES?
• For detections, do you prefer 'index=' or 'tstats'?
• Resources recommendations for someone starting in the security realm coming from a systems background?
• For customer that start out with InfoSec in the cloud, do you have any recommendations on getting started and making it efficient?