Understand the certification
SPLK-3003 Splunk SOAR Certified Automation Developer 是 Splunk SOAR（原 Phantom）平台的开发者认证，60 题 / 75 分钟。
Splunk SOAR 是安全编排、自动化和响应（SOAR）平台，核心能力是将安全运维流程编排为可重复执行的 Playbook — 告警触发后自动执行 IOC 查询、IP 封锁、工单创建等动作。和 SOAR Admin 认证不同，Developer 认证聚焦于 Playbook Python 开发（约 30%）、自定义 App 开发（约 20%）和 REST API 集成（约 15%）。
考试要求能读懂和编写 Python 代码 — Playbook 的 Custom Function、App Connector 的 action handler 都是 Python。约 25% 的题给一段 SOAR Python 代码问逻辑或排错。
Exam at a glance
- Exam code
- SPLK-3003
- Provider
- 其他
- Format
- single-choice / multiple-choice
- Language
- English
- Validity
- 3 years
Skills in focus
Learning outcomes
- 掌握 Splunk SOAR 平台的 Playbook 完整开发生命周期
- 能够使用 Python 开发自定义函数和 SOAR App 连接器
- 熟练配置 REST API 集成和 Webhook 触发器实现端到端自动化
- 自信通过 Splunk SOAR Certified Automation Developer（SPLK-3003）认证考试
Who this is for
- 负责在 Splunk SOAR 平台开发自动化 Playbook 的安全自动化工程师
- 需要将 EDR、防火墙、SIEM 等安全工具集成到 SOAR 平台的开发工程师
- 具备 Python 编程基础并希望进入安全自动化领域的开发人员
- 希望通过 SOAR 认证提升安全工程竞争力的 SOC 工程师
Before you start
- 具备 Python 编程能力（中级水平），熟悉函数、类、异常处理和 JSON 数据处理
- 了解 REST API 基本概念：HTTP 方法、认证方式（API Key、OAuth）、JSON 格式
- 具备安全运营基础知识：安全事件生命周期、IOC 类型、威胁响应流程
- 建议了解 Splunk 基础操作，有 SOAR 或安全编排平台使用经验者优先
Your learning path
3 chapters
Plan your preparation
- Learning hours
- 16h
- With relevant experience
- 4-6 weeks
- Starting from scratch
- 8-12 weeks
- Daily study
- 1-2h
Included in your preparation
- 152 道练习题覆盖全部 SPLK-3003 考试域
- 重点考查 Playbook 设计逻辑和 Python 自动化开发的实战场景题
- 涵盖 SOAR App 开发和 REST API 集成的高频考点
- AI 辅导功能帮助精准定位 SOAR 开发薄弱环节
- 每道题含详细解析，深入理解安全自动化开发原理
1. 第一阶段：SOAR 核心概念（1-2 周）
Container（安全事件容器）、Artifact（IOC/证据）、Asset（集成的安全工具）、Action（对 Asset 执行的操作）四个核心对象。Visual Playbook Editor（VPE）的 Decision Block、Filter、Format Block 使用。
2. 第二阶段：Playbook Python 开发 + App 开发（2-3 周）
Custom Function 的 Python 开发（输入/输出参数定义、phantom.rules API）。App Connector 开发框架：BaseConnector 类继承、handle_action 方法、action JSON 定义。在 SOAR 社区版（免费）上练习开发和调试。
3. 第三阶段：REST API + 模考（1-2 周）
SOAR REST API 端点（/rest/container、/rest/artifact、/rest/action_run）的 CRUD 操作。Playbook 的测试和调试方法。做 2 套模考，Python 代码阅读题务必快速准确。
Career value
SOAR 工程师是 SOC 自动化转型中需求增长最快的角色之一。Splunk SOAR（Phantom）在 SOAR 市场占有率约 20-25%，和 Palo Alto XSOAR 并列第一梯队。
适合考的人：在 Splunk SOAR 环境中开发 Playbook 和自定义 App 的安全自动化工程师。
不适合考的人：不写代码的 SOC 分析师，或者使用其他 SOAR 平台（XSOAR、Tines、Swimlane）的人。
- 澳洲
- AUD 130,000 – 175,000
- 美国
- USD 115,000 – 165,000
- 新加坡
- SGD 95,000 – 145,000
Preparation tips
Common mistakes
- **不熟悉 Container/Artifact 关系** — Container 是一个安全事件，Artifact 是事件中的 IOC（IP、Hash、URL 等）。Playbook 从 Container 触发，对 Artifact 执行 Action。
- **App 开发框架不熟** — BaseConnector 的 initialize/handle_action/finalize 生命周期、action 参数从 param 字典获取的方式都是考点。
- **忽略 Playbook 调试** — SOAR 的 Playbook Debugger 功能、/opt/phantom/var/log/spawn.log 日志位置都会考到。
Before you register
How difficult is the Splunk SPLK-3003 SOAR Certified Automation Developer exam?
The SPLK-3003 exam is 90 minutes long with approximately 65 single-choice and multiple-choice questions, requiring a 70% passing score. It focuses on automation development skills for the Splunk SOAR (Security Orchestration, Automation and Response) platform, including Playbook design, app development, and API integration. Programming skills and security operations experience are required.
What core knowledge domains does the SPLK-3003 exam cover?
The exam primarily tests Splunk SOAR platform architecture and components, Playbook design and development (Visual Playbook Editor and Python), SOAR app development and connector configuration, case management and workflow automation, REST API integration and custom function development, and SOAR deployment and management best practices.
What is Splunk SOAR and how does it relate to Splunk Enterprise?
Splunk SOAR (formerly Phantom) is a security orchestration, automation, and response platform used to automate security operations workflows. It integrates with Splunk Enterprise/Cloud, allowing Splunk security events to automatically trigger SOAR Playbooks for response. SOAR focuses on automated workflows, while Splunk focuses on data analysis and detection.
Do I need programming skills to prepare for SPLK-3003?
Yes, Python programming ability is essential. SOAR Playbooks can be created using the visual editor, but advanced automation requires writing Python code. The exam covers Python scripting, API calls, JSON data processing, and other technical content. At least intermediate-level Python proficiency is recommended.
Does Playbook development carry significant weight in the exam?
Playbooks are the core content of the SPLK-3003 exam. You need to master Playbook design principles, decision block and filter usage, custom function development, Playbook debugging and testing methods, and how to chain multiple Playbooks together to form complete automated response workflows.
How can I effectively prepare for the Splunk SPLK-3003 exam?
Start by familiarizing yourself with SOAR platform concepts and the Visual Playbook Editor, then dive into Python automation development and API integration. Use our platform's 152 practice questions for systematic training, focusing on Playbook design scenarios and app development questions. If possible, request the Splunk SOAR Community Edition for hands-on practice.
Learner experiences
Loading reviews…
有 Python 基础的话不难，核心是理解 SOAR 的对象模型（Container → Artifact → Action → Result）。App 开发的 BaseConnector 继承模式是高频考点 — handle_action 方法里怎么分发不同 action 的逻辑。
A. Kumar
SOAR 开发者 @ MSSP · 通过 · 5 weeks
Done reading? Next steps
- SkillPractise Splunk SPLK-3003 by exam domainQuestions are grouped by the official exam domains, so you can see which domain still needs work.Open the question bank →
- SkillSplunk SPLK-3003 learning pathWork through the exam scope chapter by chapter, then come back to the questions.See the learning path →
- ExpressionExplain it in an interviewRun a mock interview for a role that uses this certification and turn what you studied into project stories.Practise an interview →
Start with the first chapter.
2 free chapters · Full preparation from $39