Get in Touch

Course Outline

Introduction to ArcSight ESM

  • Overview of SIEM and ArcSight ESM.
  • Understanding the ArcSight ESM architecture.

Configuring ArcSight Connectors

  • Types of ArcSight connectors and their purposes.
  • Installing and configuring ArcSight connectors.
  • Managing connector updates and health.

ArcSight ESM Management

  • Navigating the ArcSight Console.
  • Managing users, groups, and permissions.
  • Configuring network and device resources.

Correlation Rules and Security Monitoring

  • Basics of correlation rules and their creation.
  • Deploying correlation rules for real-time threat detection.
  • Utilizing the dashboard for security monitoring.

Reporting and Visualization

  • Creating custom reports for security analytics.
  • Designing effective dashboards and visualizations.
  • Best practices for reporting and alerting.

Active Lists, Session Lists, and Data Monitors

  • Introduction to lists and data monitors in ArcSight.
  • Configuring and managing lists for dynamic threat detection.
  • Practical applications of data monitors.

Tool Optimization

  • Customizing dashboards for enhanced operational visibility.
  • Streamlining event streams for efficient monitoring and analysis.

Advanced Variable Construction and Developing Lists and Rules

  • Techniques for creating complex variables in ArcSight.
  • Using variables to filter and refine event data.
  • Developing and managing lists for dynamic event categorization.
  • Creating advanced rules for automated threat detection and response.

Advanced Correlation Techniques and Search Methods

  • Strategies for correlating disparate event data to uncover sophisticated threats.
  • Applying advanced correlation for real-world threat scenarios.
  • Leveraging ArcSight's search capabilities for deep-dive investigations and threat hunting.
  • Tips and tricks for constructing effective search queries.

System Maintenance and Troubleshooting

  • ArcSight ESM backup and restore procedures.
  • Monitoring system performance and troubleshooting common issues.
  • Best practices for ArcSight ESM maintenance.

Summary and Next Steps

Requirements

  • Basic understanding of cybersecurity concepts and SIEM (Security Information and Event Management) fundamentals.
  • Previous experience with Micro Focus ArcSight ESM.

Audience

  • Security analysts.
  • Cybersecurity and IT professionals.
 35 Hours

Number of participants


Price per participant

Testimonials (1)

Upcoming Courses

Related Categories