Get in Touch

Course Outline

Open-Source SIEM Sovereignty for Government

  • How cloud-based Security Information and Event Management (SIEM) systems can introduce compliance and cost risks related to log retention for government.
  • Overview of the Wazuh architecture, including its server, indexer, dashboard, and agents for government use.
  • Comparative analysis of Wazuh with Splunk, Microsoft Sentinel, Elastic Security, and IBM QRadar for government applications.

Deployment and Architecture for Government

  • Single-node and distributed deployment patterns suitable for government operations.
  • Docker Compose and Kubernetes manifests for efficient deployment in government environments.
  • Hardware sizing requirements, including CPU, RAM, and disk IOPS, to support log ingestion for government agencies.
  • Configuration of certificates and TLS for secure communication between components in government systems.

Agent Management for Government

  • Methods for installing agents via packages, Ansible, or Group Policy Objects (GPO) in government networks.
  • Procedures for agent enrollment, key exchange, and group assignment within government agencies.
  • Agentless monitoring options using syslog, AWS S3, or API polling for government data sources.
  • Strategies for upgrading agents across large fleets in government environments.

Detection Engineering for Government

  • Development of decoders and rules for log parsing and event extraction to meet government standards.
  • Mapping of detection rules to the MITRE ATT&CK framework to support government threat intelligence.
  • Implementation of file integrity monitoring (FIM) and rootkit detection capabilities for government systems.
  • Creation of custom rules using XML and YAML syntax tailored to government requirements.
  • Integration of threat intelligence feeds from sources such as MISP, VirusTotal, and AlienVault for enhanced government security.

Incident Response and Automation for Government

  • Active response capabilities, including firewall blocking, account disabling, and process termination, to protect government assets.
  • Integration with Security Orchestration, Automation, and Response (SOAR) platforms like Shuffle, n8n, or custom webhooks for efficient incident management in government settings.
  • Techniques for alert correlation and multi-stage attack chaining to enhance government threat detection.
  • Case management processes and evidence preservation strategies for government investigations.

Compliance and Reporting for Government

  • Mapping of Wazuh controls to compliance frameworks such as PCI-DSS, HIPAA, GDPR, and NIST for government agencies.
  • Policy monitoring capabilities for password strength, encryption, and patch management in government systems.
  • Generation and export of scheduled reports to support government audit and compliance requirements.
  • Ensuring the integrity and tamper detection of audit trails for government oversight.

Dashboards and Visualization for Government

  • Customization options for Wazuh dashboards and widget creation to meet government reporting needs.
  • Integration with Grafana for advanced visualizations in government environments.
  • Compatibility with Kibana for legacy Elastic deployments within government agencies.
  • Development of executive and operational Security Operations Center (SOC) views tailored for government users.

Maintenance and Scaling for Government

  • Management of indexer shards and implementation of hot-warm-cold archiving strategies to optimize performance in government systems.
  • Development of log retention policies and legal hold procedures to ensure compliance with government regulations.
  • Strategies for disaster recovery and cluster rebuild operations to maintain continuity in government operations.

Requirements

  • Intermediate skills in Linux and Windows system administration.
  • Knowledge of SIEM concepts, including correlation, alerting, and log aggregation.
  • Experience with the Elastic Stack or OpenSearch.

Audience

  • Security operations centers transitioning from commercial SIEM solutions.
  • Compliance teams requiring on-premises log retention capabilities.
  • Government agencies needing sovereign threat detection and management for government operations.
 21 Hours

Number of participants


Price per participant

Testimonials (4)

Upcoming Courses

Related Categories