|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/fortisiem-engineers-guide-for-deployment-and-configuration/
课程评论：没有评论
**课程名称：**FortiSIEM 部署与配置工程师指南 **课程概述：** 本课程为期超过300分钟，旨在帮助安全工程师、SOC分析师、MSSP专业人士和IT管理员掌握Fortinet FortiSIEM平台的部署、配置和运营管理。课程内容涵盖企业级和MSSP环境下的实施策略，从基础概念到进阶应用。FortiSIEM是一款强大的、可扩展的安全信息和事件管理（SIEM）解决方案，结合了安全监控和性能分析。无论您是FortiSIEM新手还是希望提升部署和调优技能，本课程都将为您提供构建、定制和维护健壮安全监控环境所需的知识和工具。 **学习内容：** * **FortiSIEM架构概览：** 了解Supervisor、Worker、Collector和Database等核心组件，以及SMB、企业和MSSP的部署模型。 * **安装与初始设置：** 学习系统需求、EPS/GB/天的容量规划、VM和硬件 appliance 部署、网络架构和部署规划。 * **设备集成与日志收集：** 学习设备（Fortinet、Cisco、Windows、Linux、Palo Alto等）的接入，配置syslog、SNMP、WMI及代理收集，以及排查解析器和日志接收问题。 * **解析器与事件规范化：** 学习创建自定义解析器以支持非标准日志源，调试和测试事件模式，并将事件映射到 CMDB 资产和日志类型。 * **规则、告警与关联：** 学习编写带过滤器和模式的检测规则，实现用例（如暴力破解、恶意软件活动、策略违规），告警丰富化和自动响应选项。 * **仪表板、报告与CMDB：** 学习构建基于角色的仪表板和KPI组件，生成合规性报告（PCI-DSS、ISO、NIST），以及管理配置管理数据库（CMDB）。 * **多租户与MSSP配置：** 学习隔离租户数据和访问，设计可扩展的MSSP架构，资源分配和性能优化。 * **系统加固与最佳实践：** 学习备份和灾难恢复计划，保留、存储和归档配置，性能调优和EPS优化。 * **进阶主题：** 威胁情报（CTI）集成，Playbook和事件响应自动化，API使用以集成外部系统（SOAR、工单系统等）。 **适合人群：** * 安全工程师和分析师 * SOC经理和架构师 * MSSP运营商 * Fortinet合作伙伴和顾问 * 寻求内部SIEM解决方案的IT管理员 **先修知识：** * 具备基础的网络和安全操作知识。 * 熟悉Fortinet或其他安全工具（有益，非强制）。 * 理解日志格式和系统日志。 **课程特色：** * 超过5小时的视频内容 * 动手实验演示 * 真实世界实施场景 * 测验和配置流程讲解 * 可下载的文档模板和脚本 * 访问私人问答论坛
FortiSIEM - Engineer's Guide for Deployment and ConfigurationCourse Description:This comprehensive, hands-on course is designed for security engineers, SOC analysts, MSSP professionals, and IT administrators who want to master the deployment, configuration, and operational management of Fortinet's FortiSIEM platform. Covering over 300 minutes of in-depth training, this course takes you from foundational concepts to advanced implementation strategies across real-world enterprise and MSSP environments.FortiSIEM is a powerful, scalable Security Information and Event Management (SIEM) solution that combines security monitoring with performance analytics. Whether you're new to FortiSIEM or looking to refine your deployment and tuning skills, this course equips you with the knowledge and tools needed to build, customize, and maintain a robust security monitoring environment.What You Will Learn:FortiSIEM Architecture OverviewUnderstanding core components: Supervisor, Worker, Collector, and DatabaseDeployment models for SMBs, Enterprises, and MSSPsInstallation and Initial SetupSystem requirements and sizing for EPS/GB/dayVM-based and hardware appliance deploymentsNetwork architecture and deployment planningDevice Integration and Log CollectionOnboarding devices (Fortinet, Cisco, Windows, Linux, Palo Alto, etc.)Configuring syslog, SNMP, WMI, and agent-based collectionTroubleshooting parser and log ingestion issuesParser and Event NormalizationCustom parser creation for unsupported log sourcesDebugging and testing event patternsMapping events to CMDB assets and log typesRules, Alerts, and CorrelationWriting detection rules with filters and patternsUse case implementation (Brute Force, Malware Activity, Policy Violations)Alert enrichment and auto-remediation optionsDashboards, Reports, and CMDBBuilding role-based dashboards and KPI widgetsGenerating compliance-ready reports (PCI-DSS, ISO, NIST)Managing the Configuration Management Database (CMDB)Multi-Tenancy and MSSP ConfigurationIsolating tenant data and accessDesigning scalable MSSP architectureResource allocation and performance optimizationSystem Hardening and Best PracticesBackup and disaster recovery planningRetention, storage, and archive configurationPerformance tuning and EPS optimizationAdvanced TopicsThreat intelligence (CTI) integrationPlaybook and incident response automationAPI usage for integration with external systems (SOAR, ticketing, etc.)Who Should Take This Course:Security Engineers and AnalystsSOC Managers and ArchitectsMSSP OperatorsFortinet Partners and ConsultantsIT Admins seeking in-house SIEM solutionsPrerequisites:Basic knowledge of networking and security operationsFamiliarity with Fortinet or other security tools (helpful, not mandatory)Understanding of log formats and system logsCourse Features:5+ hours of video contentHands-on lab demonstrationsReal-world implementation scenariosQuizzes and configuration walkthroughsDownloadable documentation templates and scriptsAccess to a private Q & A forum
