Course Outline
Open-Source SIEM Sovereignty for Government
- How cloud-based Security Information and Event Management (SIEM) systems can introduce compliance and cost risks related to log retention for government.
- Overview of the Wazuh architecture, including its server, indexer, dashboard, and agents for government use.
- Comparative analysis of Wazuh with Splunk, Microsoft Sentinel, Elastic Security, and IBM QRadar for government applications.
Deployment and Architecture for Government
- Single-node and distributed deployment patterns suitable for government operations.
- Docker Compose and Kubernetes manifests for efficient deployment in government environments.
- Hardware sizing requirements, including CPU, RAM, and disk IOPS, to support log ingestion for government agencies.
- Configuration of certificates and TLS for secure communication between components in government systems.
Agent Management for Government
- Methods for installing agents via packages, Ansible, or Group Policy Objects (GPO) in government networks.
- Procedures for agent enrollment, key exchange, and group assignment within government agencies.
- Agentless monitoring options using syslog, AWS S3, or API polling for government data sources.
- Strategies for upgrading agents across large fleets in government environments.
Detection Engineering for Government
- Development of decoders and rules for log parsing and event extraction to meet government standards.
- Mapping of detection rules to the MITRE ATT&CK framework to support government threat intelligence.
- Implementation of file integrity monitoring (FIM) and rootkit detection capabilities for government systems.
- Creation of custom rules using XML and YAML syntax tailored to government requirements.
- Integration of threat intelligence feeds from sources such as MISP, VirusTotal, and AlienVault for enhanced government security.
Incident Response and Automation for Government
- Active response capabilities, including firewall blocking, account disabling, and process termination, to protect government assets.
- Integration with Security Orchestration, Automation, and Response (SOAR) platforms like Shuffle, n8n, or custom webhooks for efficient incident management in government settings.
- Techniques for alert correlation and multi-stage attack chaining to enhance government threat detection.
- Case management processes and evidence preservation strategies for government investigations.
Compliance and Reporting for Government
- Mapping of Wazuh controls to compliance frameworks such as PCI-DSS, HIPAA, GDPR, and NIST for government agencies.
- Policy monitoring capabilities for password strength, encryption, and patch management in government systems.
- Generation and export of scheduled reports to support government audit and compliance requirements.
- Ensuring the integrity and tamper detection of audit trails for government oversight.
Dashboards and Visualization for Government
- Customization options for Wazuh dashboards and widget creation to meet government reporting needs.
- Integration with Grafana for advanced visualizations in government environments.
- Compatibility with Kibana for legacy Elastic deployments within government agencies.
- Development of executive and operational Security Operations Center (SOC) views tailored for government users.
Maintenance and Scaling for Government
- Management of indexer shards and implementation of hot-warm-cold archiving strategies to optimize performance in government systems.
- Development of log retention policies and legal hold procedures to ensure compliance with government regulations.
- Strategies for disaster recovery and cluster rebuild operations to maintain continuity in government operations.
Requirements
- Intermediate skills in Linux and Windows system administration.
- Knowledge of SIEM concepts, including correlation, alerting, and log aggregation.
- Experience with the Elastic Stack or OpenSearch.
Audience
- Security operations centers transitioning from commercial SIEM solutions.
- Compliance teams requiring on-premises log retention capabilities.
- Government agencies needing sovereign threat detection and management for government operations.
Testimonials (4)
learning about Basel
Daksha Vallabh - Standard Bank of SA Ltd
Course - Basel III – Certified Basel Professional
Speed of response and communication
Bader Bin rubayan - Lean Business Services
Course - ISO/IEC 27001 Lead Implementer
Risk optimization is more clear than the other subjects
Munirah Alsahli - GOSI
Course - CGEIT – Certified in the Governance of Enterprise IT
The knowledge and understanding of the trainer on the training material was exceptional. The trainer was well aware of the subject, provided practical examples in relevance. I would highly recommend him as a trainer for this training.