Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Open-Source SIEM Sovereignty
- The compliance and cost risks associated with cloud-based SIEMs for log retention.
- Wazuh architecture overview: server, indexer, dashboard, and agents.
- Detailed comparison with Splunk, Sentinel, Elastic Security, and QRadar.
Deployment and Architecture
- Single-node versus distributed deployment patterns.
- Utilizing Docker Compose and Kubernetes manifests for setup.
- Hardware sizing guidelines: CPU, RAM, and disk IOPS for effective log ingestion.
- Configuring certificates and TLS for secure component communication.
Agent Management
- Installing agents via packages, Ansible automation, or Group Policy Objects (GPO).
- Managing agent enrollment, key exchange, and group assignments.
- Implementing agentless monitoring through syslog, AWS S3, or API polling.
- Strategies for upgrading agents across large, distributed fleets.
Detection Engineering
- Using decoders and rules for efficient log parsing and event extraction.
- Mapping rule categories to the MITRE ATT&CK framework.
- Implementing File Integrity Monitoring (FIM) and rootkit detection.
- Writing custom rules using XML and YAML syntax.
- Integrating threat intelligence from MISP, VirusTotal, and AlienVault.
Incident Response and Automation
- Active response actions: firewall blocking, account disabling, and process termination.
- SOAR integration using Shuffle, n8n, or custom webhooks.
- Alert correlation techniques and multi-stage attack chaining.
- Case management workflows and evidence preservation practices.
Compliance and Reporting
- Mapping controls to PCI-DSS, HIPAA, GDPR, and NIST standards.
- Monitoring policies for password strength, encryption standards, and patching compliance.
- Scheduling report generation and data export.
- Ensuring audit trail integrity and detecting tampering.
Dashboards and Visualization
- Customizing Wazuh dashboards and creating specific widgets.
- Integrating Grafana for advanced visualization capabilities.
- Maintaining Kibana compatibility for legacy Elastic deployments.
- Developing executive overviews and operational SOC views.
Maintenance and Scaling
- Managing indexer shards and implementing hot-warm-cold archiving strategies.
- Defining log retention policies and legal hold procedures.
- Disaster recovery planning and cluster rebuilding processes.
Requirements
- Intermediate proficiency in Linux and Windows system administration.
- A solid understanding of SIEM concepts, including correlation, alerting, and log aggregation.
- Practical experience with the Elastic Stack or OpenSearch.
Audience
- Security operations centers seeking to replace commercial SIEM solutions.
- Compliance teams requiring on-premise log retention capabilities.
- Government agencies needing sovereign threat detection frameworks.
Testimonials (1)
The trainer was helpful..
