Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
Open-Source Search and Analytics Sovereignty for Government
- Elastic license modifications and community-driven forks.
- Feature parity between OpenSearch and Elasticsearch expected in 2025-2026.
- Use cases include enterprise search, log analytics, security information and event management (SIEM), and observability for government operations.
Cluster Architecture
- Node roles: master, data, coordinating, and ingest nodes.
- Security plugin features: Transport Layer Security (TLS) internode communication, certificate management, and Public Key Infrastructure (PKI).
- Split-brain prevention mechanisms: configuration of discovery.seed_hosts and minimum master nodes to ensure cluster integrity.
Data Ingestion
- REST API for indexing, bulk loading, and mapping definition management.
- Data pipeline tools: Beats, Fluent Bit, and Logstash for efficient data collection and processing.
- OpenTelemetry Collector for capturing traces and metrics to enhance observability.
Search and Dashboards
- Query DSL capabilities: match, term, range queries, aggregations, and nested fields support.
- OpenSearch Dashboards for creating visualizations and interactive dashboards to enhance data analysis.
- SIEM use cases: implementation of alert rules and anomaly detection to strengthen cybersecurity for government systems.
Index Management
- Index Lifecycle Management (ILM) features: rollover, shrinking, and deletion policies.
- Hot-warm-cold architecture to optimize resource utilization and cost efficiency.
- Mapping optimization techniques and text analysis for improved data retrieval and processing.
Security and Access Control
- Role-Based Access Control (RBAC) with user, role, and tenant management to ensure secure access.
- SAML and OpenID Connect authentication methods for robust identity verification.
- Document-level security measures and field masking to protect sensitive information.
Backup and Recovery
- Snapshot repositories: storage options include MinIO, Amazon S3, or Network File System (NFS) for reliable data backup.
- Automated snapshot management using Curator or Index State Management (ISM) to streamline the backup process.
- Restoration capabilities: restoring specific indices and implementing cluster-wide disaster recovery strategies to ensure business continuity.
Requirements
- Familiarity with search engines and inverted indexes.
- Experience working with REST APIs and JSON.
- Basic Linux administration skills, including systemd, logs, and package management.
Audience
- Search and log analytics engineers for government agencies.
- Teams transitioning from managed Elasticsearch or Splunk solutions.
- Security analysts developing sovereign SIEM backends.
14 Hours
Testimonials (1)
the trainer was very good and made the training perfect for my needs
