Arcsight ESM

Day-1

Module-1: Introduction to SIEM

 What is SIEM
 SIEM Components
 Understanding ESM Sizing
 Deployment Methodology
 Licensing Microfocus SIEM

Module-2: Components

 ESM Anotomy
 Arcisght Manager & CORR-Engine storage
 User interfaces & Use cases
 Interactive Discovery & Pattern Discovery
 Getting The Software + ArcSight Console Simplified

Module-3: Deployment

 ESM installation
 Life Cycle of an Event Through ESM
 Console overview

Module-4: Smart connectors

 Types of Smart connectors

 Smart Connector Installation & ESM destination registration
 Syslog connector
 Understanding Flex Connectors
 Understanding Forwarding connectors

Day-2

Module-5: Data collection

 Data Collection and Event Processing - Collect & Normalize Event Data
 Data Collection and Event Processing - Apply Event Categories
 Event categorization Utility
 Data Collection and Event Processing - Look up Customer and Zone in Network Mode
 Data Collection and Event Processing - Filter/Aggregate/Managing SmartConnector
  Filter and Aggregate Events
 Priority Evaluation and Network Model Lookup
 Workflow

Module-6: Correlation

 Correlation Overview & Filters & Rules

 How Rules Evaluated & Use Active/Session Lists
 Data Monitors
 Local and Global Variables & Velocity Templates
 Event Types

Module-7: administration

 ArcSight ESM Admin Authentication

 ArcSight ESM CORRE Back Up and Restore
 Managing CORRE Daily Partitions
 Using ArcSight Packages
 Maintaining CORRE System Health

Day-3: ESM analysis

Module-8: Viewing ArcSight ESM Data

 Using Active Channels

 Using Filters
 Using Variables
 Using Dashboards and Data Monitors
 Using Event Graphs
 Using Custom View Dashboards
 Creating Dashboards
 Customizing Dashboards

Module-9: ArcSight ESM Rules and Lists

 ESM Rules Basics

 Using Lists

Day-4:
Module-10: ArcSight ESM Reports and Query Viewers

 ESM Reports Overview

 Building Reports
 ArcSight Query Viewers

Module-11: ArcSight ESM Network Model

 ArcSight Network and Asset Model

 Network Model Wizard

Module-12: UEBA

 Generating user based reports

 Monitoring Health activities

Day-5: Arcsight logger

 Introduction to Logger
 Install and Initialize Logger Appliance
 Installing and Initialize Software Logger
 Navigating Logger
 Logger Configuration
 Configuring Logger Event Input and Output
 System Admin Settings
 Managing Users and Groups
 Event Search
 Search Tools
 Filters, Saves Searches & Scheduled Alerts
 Logger Reports