Get in Touch
 Duration 35 hours

Course Outline

Introduction to ArcSight ESM for government

  • Overview of SIEM frameworks and ArcSight ESM capabilities
  • Analysis of the ArcSight ESM architectural components

Configuration of ArcSight Connectors

  • Classification of ArcSight connector types and their operational purposes
  • Installation and configuration protocols for ArcSight connectors
  • Oversight of connector updates and health status monitoring

Administrative Management of ArcSight ESM

  • Navigational controls within the ArcSight Console interface
  • Governance of user accounts, group assignments, and access permissions
  • Configuration of network infrastructure and device resource parameters

Correlation Rules and Security Surveillance

  • Foundational principles of correlation rule logic and creation
  • Deployment strategies for real-time threat identification via correlation rules
  • Utilization of dashboard interfaces for continuous security monitoring

Reporting and Data Visualization

  • Generation of custom reports for security analytics for government
  • Design methodologies for effective dashboards and visual data representations
  • Establishment of best practices for reporting standards and alerting mechanisms

Active Lists, Session Lists, and Data Monitors

  • Overview of list structures and data monitors within the ArcSight framework
  • Configuration and management of lists for dynamic threat detection workflows
  • Application of data monitors in practical security scenarios

Tool Optimization Strategies

  • Customization of dashboards to enhance operational visibility and situational awareness
  • Streamlining of event streams to ensure efficient monitoring and analytical processing

Advanced Variable Construction and List/Rule Development

  • Methodologies for constructing complex variables within ArcSight environments
  • Application of variables to filter and refine event data for precision analysis
  • Development and administration of lists for dynamic event categorization
  • Creation of advanced rules to support automated threat detection and response protocols

Advanced Correlation Techniques and Search Methodologies

  • Strategic approaches for correlating disparate event data to identify sophisticated threats
  • Implementation of advanced correlation techniques for real-world threat scenarios
  • Leveraging ArcSight search capabilities for detailed investigations and threat hunting
  • Optimization tips for constructing effective and efficient search queries

System Maintenance and Diagnostic Procedures

  • Standard operating procedures for ArcSight ESM backup and restoration
  • Performance monitoring protocols and troubleshooting for common system issues
  • Best practices for ongoing ArcSight ESM system maintenance

Summary and Recommended Next Steps

Requirements

  • Fundamental knowledge of cybersecurity concepts and Security Information and Event Management (SIEM) principles
  • Prior professional experience with Micro Focus ArcSight ESM

Target Audience

  • Security analysts
  • Cybersecurity and information technology professionals

Number of participants


Price per participant

Testimonials (1)

Upcoming Courses

Related Categories