ArcSight Logger & ESM Hands-On

Get Hands-On Experience on Logger & ESM which are main OpenText ArcSight components

Created by: Hatem Metwally
Senior Security Consultant

What Will I Learn?

• ArcSight Logger and ESM Hands-On
• SIEM platform that unifies data collection and log management
• A Log Management Solution
• Ingesting Windows Security Events
• Building dashboards
• ESM Anatomy
• SmartConnectors
• ArcSight Manager & CORR-EngineStorage
• User Interfaces & Use Cases
• Interactive Discovery & Pattern Discovery
• ESM on an Appliance & Logger & ArcSight Solutions
• Life Cycle of an Event Through ESM
• Data Collection and Event Processing - Collect & Normalize Event Data
• Data Collection and Event Processing - Apply Event Categories
• Data Collection and Event Processing - Look up Customer and Zone in Network Model
• Data Collection and Event Processing - Filter and Aggregate Events & Managing SmartConnector Configurations
• Priority Evaluation and Network Model Lookup
• Workflow
• Correlation Evaluation - Correlation Overview & Filters & Rules
• Correlation Evaluation - How Rules are Evaluated & How Rules Use Active & Session Lists
• Correlation Evaluation - Data Monitors
• Correlation Evaluation - How Correlation Uses Local and Global Variables & Velocity Templates
• Correlation Evaluation - Event Types
• ESM Administration
• ArcSight Theory
• Import packages from ArcSight marketplace
• Sysmon
• Brute Force

Requirements

• Basic Unix/Linux skills

Target audience

• Security Administrator, Analyst, Consultant, SOC, Architect