Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 40 hours
Course Outline
Introduction to ArcSight ESM
- Overview of SIEM and ArcSight ESM.
- Understanding the ArcSight ESM architecture.
Configuring ArcSight Connectors
- Exploring the types of ArcSight connectors and their respective purposes.
- Installing and configuring ArcSight connectors.
- Managing connector updates and health monitoring.
ArcSight ESM Management
- Navigating the ArcSight Console.
- Administering users, groups, and permissions.
- Configuring network and device resources.
Correlation Rules and Security Monitoring
- Foundations of correlation rules and the creation process.
- Deploying correlation rules for immediate threat detection.
- Leveraging the dashboard for continuous security monitoring.
Reporting and Visualization
- Generating custom reports for security analytics.
- Designing intuitive dashboards and visualizations.
- Best practices for reporting and alert management.
Active Lists, Session Lists, and Data Monitors
- Introduction to lists and data monitors within ArcSight.
- Configuring and managing lists for dynamic threat detection.
- Practical uses of data monitors.
Tool Optimization
- Tailoring dashboards for improved operational visibility.
- Streamlining event streams for efficient monitoring and analysis.
Advanced Variable Construction and Developing Lists and Rules
- Techniques for building complex variables in ArcSight.
- Utilizing variables to filter and refine event data.
- Developing and managing lists for dynamic event categorization.
- Creating advanced rules for automated threat detection and response.
Advanced Correlation Techniques and Search Methods
- Strategies for correlating diverse event data to reveal sophisticated threats.
- Applying advanced correlation to real-world threat scenarios.
- Utilizing ArcSight’s search capabilities for in-depth investigations and threat hunting.
- Essential tips for crafting effective search queries.
System Maintenance and Troubleshooting
- ArcSight ESM backup and restore procedures.
- Monitoring system performance and resolving common issues.
- Best practices for ArcSight ESM maintenance.
Advanced Practical Workshop
- Detection tuning and validation: Testing correlation rules against sample events, adjusting thresholds and time windows, and minimizing false positives.
- Incident investigation capstone: Investigating a simulated attack using searches, active lists, dashboards, and correlated events; documenting the incident timeline and findings.
- Practical assessment and review: Presenting investigation findings, explaining detection logic and tuning decisions, and reviewing potential improvements.
Requirements
- Fundamental understanding of cybersecurity principles and SIEM (Security Information and Event Management) basics.
- Previous practical experience with Micro Focus ArcSight ESM.
Target Audience
- Security analysts.
- Cybersecurity and IT professionals.
Testimonials (1)
The report and rules setup.
