Course Outline

Introduction to ArcSight ESM

  • Overview of SIEM and ArcSight ESM
  • Understanding the ArcSight ESM architecture

Configuring ArcSight Connectors

  • Types of ArcSight connectors and their purposes
  • Installing and configuring ArcSight connectors
  • Managing connector updates and health

ArcSight ESM Management

  • Navigating the ArcSight Console
  • Managing users, groups, and permissions
  • Configuring network and device resources

Correlation Rules and Security Monitoring

  • Basics of correlation rules and their creation
  • Deploying correlation rules for real-time threat detection
  • Utilizing the dashboard for security monitoring

Reporting and Visualization

  • Creating custom reports for security analytics
  • Designing effective dashboards and visualizations
  • Best practices for reporting and alerting

Active Lists, Session Lists, and Data Monitors

  • Introduction to lists and data monitors in ArcSight
  • Configuring and managing lists for dynamic threat detection
  • Practical applications of data monitors

Tool Optimization

  • Customizing dashboards for enhanced operational visibility
  • Streamlining event streams for efficient monitoring and analysis

Advanced Variable Construction and Developing Lists and Rules

  • Techniques for creating complex variables in ArcSight
  • Using variables to filter and refine event data
  • Developing and managing lists for dynamic event categorization
  • Creating advanced rules for automated threat detection and response

Advanced Correlation Techniques and Search Methods

  • Strategies for correlating disparate event data to uncover sophisticated threats
  • Applying advanced correlation for real-world threat scenarios
  • Leveraging ArcSight's search capabilities for deep-dive investigations and threat hunting
  • Tips and tricks for constructing effective search queries

System Maintenance and Troubleshooting

  • ArcSight ESM backup and restore procedures
  • Monitoring system performance and troubleshooting common issues
  • Best practices for ArcSight ESM maintenance

Summary and Next Steps

Requirements

  • Basic knowledge of cybersecurity concepts and SIEM (Security Information and Event Management) fundamentals
  • Prior experience with Micro Focus ArcSight ESM

Audience

  • Security analysts
  • Cybersecurity and IT professionals
 35 Hours

Number of participants



Price per participant

Testimonials (1)

Related Courses

CCTV Security

14 Hours

CipherTrust Manager

21 Hours

CISA - Certified Information Systems Auditor

28 Hours

CISMP - Certificate in Information Security Management Principles

21 Hours

Computer Room Security and Maintenance

14 Hours

Mastering Continuous Threat Exposure Management (CTEM)

28 Hours

Cybersecurity Fundamentals

28 Hours

DevOps Security: Creating a DevOps Security Strategy

7 Hours

Honeywell Security System

14 Hours

Building up information security according to ISO 27005

21 Hours

Applying Psychological Science to Law Enforcement

14 Hours

NB-IoT for Developers

7 Hours

Network Penetration Testing

35 Hours

Open Authentication (OAuth)

7 Hours

Open Data Risk Analysis and Management

21 Hours

Related Categories

1