Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 35 hours
Course Outline
Introduction to ArcSight ESM
- Overview of SIEM principles and the ArcSight ESM ecosystem.
- Understanding the architectural components of ArcSight ESM.
Configuring ArcSight Connectors
- Examining various types of ArcSight connectors and their specific functions.
- Processes for installing and configuring ArcSight connectors.
- Managing connector updates and monitoring system health.
Administering ArcSight ESM
- Navigating the ArcSight Console interface effectively.
- Managing user accounts, groups, and access permissions.
- Configuring network and device resources.
Correlation Rules and Security Monitoring
- Foundations of correlation rules and methods for their creation.
- Deploying correlation rules for real-time threat detection.
- Leveraging dashboards for comprehensive security monitoring.
Reporting and Visualization
- Generating custom reports for in-depth security analytics.
- Designing impactful dashboards and visualizations.
- Best practices for reporting mechanisms and alert generation.
Active Lists, Session Lists, and Data Monitors
- Introduction to lists and data monitors within the ArcSight framework.
- Configuration and management of lists for dynamic threat detection.
- Practical use cases for data monitors.
Tool Optimization
- Customizing dashboards to improve operational visibility.
- Optimizing event streams for efficient monitoring and analysis workflows.
Advanced Variable Construction and Developing Lists and Rules
- Techniques for constructing complex variables in ArcSight.
- Utilizing variables to filter and refine event data.
- Creating and managing lists for dynamic event categorization.
- Developing advanced rules for automated threat detection and response actions.
Advanced Correlation Techniques and Search Methods
- Strategies for correlating diverse event data to reveal sophisticated threats.
- Applying advanced correlation methods to real-world threat scenarios.
- Utilizing ArcSight’s search capabilities for detailed investigations and threat hunting.
- Best practices for crafting effective search queries.
System Maintenance and Troubleshooting
- Procedures for ArcSight ESM backup and recovery.
- Monitoring system performance and resolving common technical issues.
- Best practices for ongoing ArcSight ESM maintenance.
Conclusion and Future Directions
Requirements
- Fundamental understanding of cybersecurity principles and SIEM (Security Information and Event Management) concepts.
- Previous hands-on experience with the Micro Focus ArcSight ESM platform.
Target Audience
- Security analysts.
- Cybersecurity and IT specialists.
Testimonials (1)
The report and rules setup.
