Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 40 hours
Course Outline
Introduction to ArcSight ESM
- SIEM and ArcSight ESM overview
- Understanding the ArcSight ESM architecture
Configuring ArcSight Connectors
- Types of ArcSight connectors and their functions
- Installation and configuration of ArcSight connectors
- Managing connector updates and health status
ArcSight ESM Management
- Navigating the ArcSight Console
- Administering users, groups, and permissions
- Configuring network and device resources
Correlation Rules and Security Monitoring
- Foundations of correlation rules and their creation
- Deploying correlation rules for real-time threat detection
- Leveraging the dashboard for security monitoring
Reporting and Visualization
- Generating custom reports for security analytics
- Designing effective dashboards and visualizations
- Best practices for reporting and alerting
Active Lists, Session Lists, and Data Monitors
- Introduction to lists and data monitors in ArcSight
- Configuring and managing lists for dynamic threat detection
- Practical applications of data monitors
Tool Optimization
- Customizing dashboards to improve operational visibility
- Streamlining event streams for efficient monitoring and analysis
Advanced Variable Construction and Developing Lists and Rules
- Techniques for creating complex variables in ArcSight
- Using variables to filter and refine event data
- Developing and managing lists for dynamic event categorization
- Creating advanced rules for automated threat detection and response
Advanced Correlation Techniques and Search Methods
- Strategies for correlating disparate event data to reveal sophisticated threats
- Applying advanced correlation to real-world threat scenarios
- Leveraging ArcSight's search capabilities for deep-dive investigations and threat hunting
- Tips and tricks for constructing effective search queries
System Maintenance and Troubleshooting
- ArcSight ESM backup and restore procedures
- Monitoring system performance and troubleshooting common issues
- Best practices for ArcSight ESM maintenance
Advanced Practical Workshop
- Detection tuning and validation: Test correlation rules against sample events, adjust thresholds and time windows, and reduce false positives.
- Incident investigation capstone: Investigate a simulated attack using searches, active lists, dashboards, and correlated events; document the incident timeline and findings.
- Practical assessment and review: Present investigation findings, explain detection logic and tuning decisions, and review improvements.
Requirements
- Fundamental understanding of cybersecurity principles and SIEM (Security Information and Event Management) basics.
- Prior hands-on experience with Micro Focus ArcSight ESM.
Target Audience
- Security analysts.
- Cybersecurity and IT professionals.
Testimonials (1)
The report and rules setup.
