Course Outline

Introduction to ArcSight ESM

  • Overview of SIEM and ArcSight ESM
  • Understanding the ArcSight ESM architecture

Configuring ArcSight Connectors

  • Types of ArcSight connectors and their purposes
  • Installing and configuring ArcSight connectors
  • Managing connector updates and health

ArcSight ESM Management

  • Navigating the ArcSight Console
  • Managing users, groups, and permissions
  • Configuring network and device resources

Correlation Rules and Security Monitoring

  • Basics of correlation rules and their creation
  • Deploying correlation rules for real-time threat detection
  • Utilizing the dashboard for security monitoring

Reporting and Visualization

  • Creating custom reports for security analytics
  • Designing effective dashboards and visualizations
  • Best practices for reporting and alerting

Active Lists, Session Lists, and Data Monitors

  • Introduction to lists and data monitors in ArcSight
  • Configuring and managing lists for dynamic threat detection
  • Practical applications of data monitors

Tool Optimization

  • Customizing dashboards for enhanced operational visibility
  • Streamlining event streams for efficient monitoring and analysis

Advanced Variable Construction and Developing Lists and Rules

  • Techniques for creating complex variables in ArcSight
  • Using variables to filter and refine event data
  • Developing and managing lists for dynamic event categorization
  • Creating advanced rules for automated threat detection and response

Advanced Correlation Techniques and Search Methods

  • Strategies for correlating disparate event data to uncover sophisticated threats
  • Applying advanced correlation for real-world threat scenarios
  • Leveraging ArcSight's search capabilities for deep-dive investigations and threat hunting
  • Tips and tricks for constructing effective search queries

System Maintenance and Troubleshooting

  • ArcSight ESM backup and restore procedures
  • Monitoring system performance and troubleshooting common issues
  • Best practices for ArcSight ESM maintenance

Summary and Next Steps

Requirements

  • Basic knowledge of cybersecurity concepts and SIEM (Security Information and Event Management) fundamentals
  • Prior experience with Micro Focus ArcSight ESM

Audience

  • Security analysts
  • Cybersecurity and IT professionals
 35 Hours

Custom Corporate Training

Training solutions designed exclusively for businesses.

  • Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
  • Flexible Schedule: Dates and times adapted to your team's agenda.
  • Format: Online (live), In-company (at your offices), or Hybrid.
Investment

Price per private group, online live training, starting from 8000 € + VAT*

Contact us for an exact quote and to hear our latest promotions

Testimonials (1)

Upcoming Courses

Related Categories