UNLV Hits the Jackpot with Student SOC and Splunk

SIEM City

Launched in 2022, UNLV’s SOC program gives cybersecurity students real-world SOC experience and essential workforce development skills, including responding to alerts, correlating tickets, prioritizing incidents, and resolving critical vulnerabilities. And their efforts are paying off. “We’ve substantially increased visibility in our vulnerability management program through Splunk dashboarding and alerting,” says Griffin. “Since May of 2024, the students have remediated over 600 vulnerabilities, with nearly 100 of them critical.” So while UNLV students get smarter, the school gets safer.

“When we started, this was a manual process of logging into multiple platforms, manually examining the data or results of the scan, and then creating the ticket, hoping there wouldn’t be duplicates or errors,” says Griffin. Now, UNLV SOC analysts leverage Splunk Enterprise Security to ingest and correlate data for various operational use cases. Any suspicious activity in their network triggers a notable event, which initiates further investigation. Griffin and his team are working toward having Splunk automate this process by ingesting the data from multiple sources, correlating it, and using workflow actions to connect to their ticketing system. “Those vulnerabilities used to take twice as long to remediate as they do now,” continues Griffin. “And when we fully implement the automation, it will cut that time to one-tenth.”

Built-in features like adaptive response have also been game-changers since using them for additional drill-down searching enables the student analysts to get more granular. Having preconfigured options and the ability to access external sites also streamline processes.

“Splunk Enterprise Security has significantly increased our visibility,” says Griffin. “We went from knowing things were happening in our environment to being able to see everything and address them as they come up. We’ve entered a world where detection is now possible.”

“With Splunk Enterprise Security, not only has our university’s security posture improved, but the academic experience has as well,” says UNLV Chief Information Security Officer Vito Rocco. “Providing students with hands-on experience in a real SOC broadens their horizons and opportunities once they enter the workforce.”

UNLV Chief Information Officer Kivanc Oner, who works with Rocco seeking grants and approvals from the state, agrees, adding: “Not only does this program empower our students with cutting-edge skills, but it also strengthens Nevada’s cybersecurity landscape as a whole. By training the next generation of cybersecurity leaders, we’re ensuring the state’s digital future is in capable hands. Splunk is a critical partner in this mission, helping us bridge education and real-world application.”

It goes without saying that these students are hard at work, earning up to 1000 hours of hands-on SOC experience over the course of a single year. Not surprisingly, UNLV’s SOC program boasts a 100% job placement rate post-graduation. According to Griffin, the vast majority of students continue to work in cybersecurity — from major retail companies to the U.S. military — and all of them leave with their Splunk Core Certified Power User certification. “The students and their drive as a part of this program and their desire to use Splunk and understand what a great tool it is culminates in this exceptional opportunity,” he says.