|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/micro-focus-arcsight-siem-a-step-by-step-bootcamp/
课程评论：没有评论
**课程名称：** ArcSight SIEM - A Step-by-Step BootCamp **课程概述：** 本课程旨在帮助渴望进入SIEM领域并学习领先SIEM技术Micro Focus ArcSight的学员。通过循序渐进的方式，您将深入理解SIEM的概念，并获得ArcSight的实际操作经验。 **新增内容（ArcSight Logger）：** * ArcSight Logger安装（4讲） * ArcSight Logger GUI详解 * Logger数据摄取及仪表板创建（2讲） **课程内容涵盖：** * SIEM基础概念 * ArcSight SIEM介绍 * ESM（Enterprise Security Management）提升态势感知能力 * ESM架构解析 * SmartConnectors（智能连接器） * ArcSight Manager与CORR-Engine * 数据存储 * 用户界面与用例 * 交互式发现与模式发现 * ESM设备部署、Logger与ArcSight解决方案 * 事件在ESM中的生命周期 * 数据收集与事件处理（收集与规范化事件数据、应用事件分类、网络模型查询客户与区域、过滤与聚合事件、管理SmartConnector配置） * 优先级评估与网络模型查询 * 工作流程 * 关联评估（关联概述与过滤器、规则评估机制与Active/Session列表的应用、数据监视器、局部与全局变量及Velocity模板在关联中的应用、事件类型） * 事件处理（修复日志源时间、遗忘ESM账户密码与禁用账户处理） **ArcSight Marketplace集成：** * 导入Brute Force包 * 导入Sysmon包
Do you want to enter the SIEM field? Do you want to learn one of the leaders SIEM technologies? Do you want to understand the concepts and gain the hands-on on Micro Focus ArcSight SIEM? Then this course is designed for you. Through baby steps you will learn Micro Focus ArcSight SIEMNew section added for ArcSight Logger that includesMicrofocus ArcSight Logger Installation (4 lectures)Microfocus ArcSight Logger GUI DemystifiedIngesting Data in Logger and create Dashboards (2 lectures)The course covers the following lessons:Import Brute Force package from ArcSight marketplaceImport Sysmon package from ArcSight marketplaceWhat is SIEMArcSight SIEMESM Enables Situational AwarenessESM AnatomySmartConnectorsArcSight Manager & CORR-EngineStorageUser Interfaces & Use CasesInteractive Discovery & Pattern DiscoveryESM on an Appliance & Logger & ArcSight SolutionsLife Cycle of an Event Through ESMData Collection and Event Processing - Collect & Normalize Event DataData Collection and Event Processing - Apply Event CategoriesData Collection and Event Processing - Look up Customer and Zone in Network ModelData Collection and Event Processing - Filter and Aggregate Events & Managing SmartConnector ConfigurationsPriority Evaluation and Network Model LookupWorkflowCorrelation Evaluation - Correlation Overview & Filters & RulesCorrelation Evaluation - How Rules are Evaluated & How Rules Use Active & Session ListsCorrelation Evaluation - Data MonitorsCorrelation Evaluation - How Correlation Uses Local and Global Variables & Velocity TemplatesCorrelation Evaluation - Event TypesFixing Time of Log SourceForgotten ESM Account Password and Disabled Account
