This Building Security Use Cases with ArcSight ESM training course provides the detailed knowledge of the ArcSight security problem solving methodology, within the ESM context. In this course, you learn the methodologies to develop use cases for current business scenarios, derived from the top business drivers in the market. During the training, you will learn to:
- Identify business drivers to develop Use Cases using ArcSight ESM
- Identify Use Case problems and requirement statements associated with actual scenarios
- Using the Use Case worksheet, document the Use Case
- Develop ArcSight ESM content to accommodate Use Case discrete objectives
By attending Building Security Use Cases with ArcSight ESM workshop, delegates will learn:
- Using the Use Case worksheet, form an initial problem statement, generate requirement statements, and prioritize objectives
- Identify data sources and ESM resources required to fulfil the objectives of the Use Case
- Create identified ESM content
- Construct ArcSight Active Channels to provide advanced analysis of the event stream
- Develop ArcSight Rules to allow correlation activities
- Build event-based data monitors to provide real-time viewing of event traffic
- Package formulated ESM content for the Use Case into an ArcSight Resource Bundle
- Common network device functions, such as routers, switches, hubs, etc.
- TCP/IP functions, such as CIDR blocks, subnets, addressing, communications, etc.
- Windows operating system tasks, such as installations, services, sharing, navigation, etc.
- SIEM terminology, such as threat, vulnerability, risk, asset, exposure, safeguards, etc.
- Security directives, such as Confidentiality, Integrity, Availability