Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 40 hours
Course Outline
Introduction to ArcSight ESM
- Overview of SIEM concepts and ArcSight ESM
- Comprehending the ArcSight ESM architecture
Setting Up ArcSight Connectors
- Exploring different ArcSight connector types and their applications
- Process for installing and configuring ArcSight connectors
- Overseeing connector updates and system health
Managing ArcSight ESM
- Navigating the ArcSight Console interface
- Administering users, groups, and access permissions
- Setting up network and device resources
Correlation Rules and Security Monitoring
- Foundations of correlation rules and their development
- Implementing correlation rules for immediate threat detection
- Utilizing dashboards for continuous security monitoring
Reporting and Visualization
- Generating custom reports for security analytics
- Designing impactful dashboards and visual representations
- Best practices for reporting and alerting mechanisms
Active Lists, Session Lists, and Data Monitors
- Understanding lists and data monitors within ArcSight
- Configuring and managing lists for dynamic threat detection
- Practical uses of data monitors
Optimizing Tools
- Tailoring dashboards for improved operational visibility
- Simplifying event streams for efficient monitoring and analysis
Advanced Variable Construction and Developing Lists and Rules
- Methods for creating complex variables in ArcSight
- Using variables to filter and refine event data
- Developing and managing lists for dynamic event categorization
- Creating advanced rules for automated threat detection and response
Advanced Correlation Techniques and Search Methods
- Strategies for correlating disparate event data to uncover sophisticated threats
- Applying advanced correlation for real-world threat scenarios
- Leveraging ArcSight's search capabilities for deep-dive investigations and threat hunting
- Tips and tricks for constructing effective search queries
System Maintenance and Troubleshooting
- ArcSight ESM backup and restore procedures
- Monitoring system performance and troubleshooting common issues
- Best practices for ArcSight ESM maintenance
Advanced Practical Workshop
- Detection tuning and validation: Test correlation rules against sample events, adjust thresholds and time windows, and reduce false positives.
- Incident investigation capstone: Investigate a simulated attack using searches, active lists, dashboards, and correlated events; document the incident timeline and findings.
- Practical assessment and review: Present investigation findings, explain detection logic and tuning decisions, and review improvements.
Requirements
- Familiarity with core cybersecurity principles and the fundamentals of Security Information and Event Management (SIEM)
- Previous hands-on experience with Micro Focus ArcSight ESM
Target Audience
- Security analysts
- Cybersecurity and IT specialists
Testimonials (1)
The report and rules setup.
