Splunk Defense Engineer deep review — September 30, 2026¶
The SPLK-5002 guide maps all 19 detailed public objectives across five domains (3/5/3/5/3) and reviews the 40 original readiness answers. The correction adds a synthetic risk-grouping worksheet and release-specific ES/SOAR boundaries. All twelve proposed product labs remain unexecuted, and independent human review is pending.
Exam scope and lifecycle¶
The complete two-page official blueprint retains the 10/40/20/20/10 percent domain weights, 60 questions, 75 total minutes including three agreement minutes, seven suggested course names, and no prerequisite exams. Power User-level Splunk knowledge and administrator familiarity are recommendations. The credential page lists professional level, USD 130 per attempt and Pearson VUE. Neither page showed a retirement or replacement statement. Scheduling, eligibility, account state and actual payment were not tested. The September 2 objective snapshot was retained; this manual reading is separate from a new automated objective hash.
Technical corrections and original example¶
The ES 8.4 findings documentation distinguishes findings from intermediate findings and says intermediate findings are not individually triaged in the analyst queue. Selected risk-modifier guidance grounds the entity, type and score explanation. The guide now treats a score as a prioritization value rather than an incident probability.
Two ES 8.5 pages conflict: the detection overview says a single detection cannot produce both output types, while its version-history text and the creation instructions describe both. The guide flags this contradiction and asks for a safe release-specific runtime check. No output behavior was invented to resolve it.
The original worksheet uses four synthetic rows, including a replay and a same-name user in another tenant. Under its chosen entity key and 30-minute window, east scores 55 and west scores 35; counting the replay would inflate east to 90. These are transparent arithmetic predictions, not observed ES results or vendor default thresholds. The metric example likewise labels 4/6 precision and 4/8 recall as values from a selected synthetic sample, not production detection performance.
The ES 8.0 limitations and 8.5+ pairing matrix support different ES/SOAR deployment combinations. The guide now requires version, topology, region and certificate checks. SOAR Cloud playbook guidance says a restart cancels a running playbook without undoing completed changes; the guide calls out that recovery boundary.
Source and execution limits¶
All fourteen unique guide links are registered. Direct checks returned five HTTP successes and nine automation blocks, with no broken links. The seven new specific Help pages were read through the public indexed reader despite direct HTTP blocks; those reading results are separate from link-health success. Only the selected article portions relevant to the guide were assessed, not complete documentation trees. Three additional public learning sites were directly reachable. The seven blueprint course names were counted, but course enrollment, delivery, duration, paid content and videos were not verified.
No Splunk Enterprise, ES, SOAR, CIM validator, search job, case, playbook, dashboard or response action ran. The twelve labs need product-version/topology, exact synthetic input, configuration/search, expected and observed outputs, negative cases, permissions and cleanup evidence. The ES 8.5 output contradiction and current course availability also remain next-pass work. The operation record at ADLC_Docs/operations/2026-09-30-splk-5002-deep-review.json contains the objective map, source boundaries, hashes and repository validation results.