Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 40 hours
Course Outline
Foundations of ArcSight ESM
- Overview of SIEM concepts and ArcSight ESM
- Comprehending the architecture of ArcSight ESM
Setting Up ArcSight Connectors
- Identifying different ArcSight connector types and their roles
- Installation and configuration of ArcSight connectors
- Oversight of connector updates and health status
Administering ArcSight ESM
- Navigating the ArcSight Console interface
- Administration of users, groups, and access permissions
- Configuration of network and device resources
Correlation Rules and Security Oversight
- Fundamentals of creating correlation rules
- Implementation of correlation rules for immediate threat detection
- Use of dashboards for security monitoring
Reporting and Data Visualization
- Generation of custom reports for security analytics
- Design of effective dashboards and visual representations
- Best practices for reporting and alert systems
Active Lists, Session Lists, and Data Monitors
- Introduction to lists and data monitors within ArcSight
- Configuration and management of lists for dynamic threat detection
- Real-world applications of data monitors
Tool Refinement
- Customization of dashboards for better operational insight
- Optimization of event streams for efficient monitoring and analysis
Advanced Variable Creation and List/Rule Development
- Methods for building complex variables in ArcSight
- Application of variables to filter and refine event data
- Development and management of lists for dynamic event classification
- Creation of advanced rules for automated threat detection and response
Sophisticated Correlation Methods and Search Strategies
- Tactics for linking diverse event data to reveal complex threats
- Application of advanced correlation in practical threat scenarios
- Utilization of ArcSight search features for in-depth investigations and threat hunting
- Strategies for crafting effective search queries
System Upkeep and Problem Solving
- Backup and restoration procedures for ArcSight ESM
- Oversight of system performance and resolution of common issues
- Recommended practices for maintaining ArcSight ESM
Advanced Practical Workshop
- Detection tuning and validation: Testing correlation rules against sample events, adjusting thresholds and time frames, and minimizing false positives.
- Incident investigation capstone: Analyzing a simulated attack using searches, active lists, dashboards, and correlated events; documenting the incident timeline and outcomes.
- Practical assessment and review: Presenting investigation results, explaining detection logic and tuning choices, and reviewing potential improvements.
Requirements
- Familiarity with core cybersecurity principles and the basics of SIEM (Security Information and Event Management)
- Previous experience working with Micro Focus ArcSight ESM
Target Audience
- Security Analysts
- IT and Cybersecurity Professionals
Testimonials (1)
The report and rules setup.
