Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 35 hours
Course Outline
Introduction to ArcSight ESM for government
- Overview of SIEM frameworks and ArcSight ESM capabilities
- Analysis of the ArcSight ESM architectural components
Configuration of ArcSight Connectors
- Classification of ArcSight connector types and their operational purposes
- Installation and configuration protocols for ArcSight connectors
- Oversight of connector updates and health status monitoring
Administrative Management of ArcSight ESM
- Navigational controls within the ArcSight Console interface
- Governance of user accounts, group assignments, and access permissions
- Configuration of network infrastructure and device resource parameters
Correlation Rules and Security Surveillance
- Foundational principles of correlation rule logic and creation
- Deployment strategies for real-time threat identification via correlation rules
- Utilization of dashboard interfaces for continuous security monitoring
Reporting and Data Visualization
- Generation of custom reports for security analytics for government
- Design methodologies for effective dashboards and visual data representations
- Establishment of best practices for reporting standards and alerting mechanisms
Active Lists, Session Lists, and Data Monitors
- Overview of list structures and data monitors within the ArcSight framework
- Configuration and management of lists for dynamic threat detection workflows
- Application of data monitors in practical security scenarios
Tool Optimization Strategies
- Customization of dashboards to enhance operational visibility and situational awareness
- Streamlining of event streams to ensure efficient monitoring and analytical processing
Advanced Variable Construction and List/Rule Development
- Methodologies for constructing complex variables within ArcSight environments
- Application of variables to filter and refine event data for precision analysis
- Development and administration of lists for dynamic event categorization
- Creation of advanced rules to support automated threat detection and response protocols
Advanced Correlation Techniques and Search Methodologies
- Strategic approaches for correlating disparate event data to identify sophisticated threats
- Implementation of advanced correlation techniques for real-world threat scenarios
- Leveraging ArcSight search capabilities for detailed investigations and threat hunting
- Optimization tips for constructing effective and efficient search queries
System Maintenance and Diagnostic Procedures
- Standard operating procedures for ArcSight ESM backup and restoration
- Performance monitoring protocols and troubleshooting for common system issues
- Best practices for ongoing ArcSight ESM system maintenance
Summary and Recommended Next Steps
Requirements
- Fundamental knowledge of cybersecurity concepts and Security Information and Event Management (SIEM) principles
- Prior professional experience with Micro Focus ArcSight ESM
Target Audience
- Security analysts
- Cybersecurity and information technology professionals
Testimonials (1)
The report and rules setup.