Duration
4 days
Overview
Security information and event management (SIEM) is an approach to security management that seeks to provide a holistic view of an organization’s information technology (IT) security. A SIEM system collects logs and other security-linked support for analysis. Most SIEM systems work by deploying multiple collection agents in a hierarchical fashion to collect security-related events from end-user devices, hosts, network equipment -- and even specialized security equipment like firewalls, antivirus or intrusion prevention systems. The collectors forward events to a centralized management console, which performs inspections and flags anomalies. To permit the scheme to identify anomalous events, it’s significant that the SIEM administrator first creates a profile of the organization under normal event conditions.
Course Objectives
- Comprehend Intrusion Tolerance, Prevention and Detection.
- Comprehend characteristics of a Robust SIEM.
- Install Alien Vault SIEM. Use Web Interface.
- Configure Sensor, Server, and Logger.
- Configure Network Inventory.
- Configure Vulnerability Scanning.
- Configure Signature Updates.
- Configure Tickets.
- Prologue to Cyberoam UTM.
- Install and configure Cyberoam.
- Monitor Security. and Logs with Cyberoam.
- Report analysis of Cyberoam.
Who Should Attend
- Security Analyst
- Security Architects
- Senior Security Engineers
- Technical Security Managers
- SOC Analysts
- SOC Engineers
- SOC Managers
- CND Analysts
- Security Monitoring
- System Administrators
- Cyber Threat Investigators
- Those who want to implement continuous security monitoring or network
- Those who are working in a hunt team capacity
Course Prerequisites
- A basic understanding of TCP/IP, logging methods and techniques, and general operating system fundamentals.
- A basic understanding of logging systems (both network and host), messaging queues, be accustomed to command-line activity, and commercial/open source SIEM solutions will be an added advantage.
Course Outline
- Introduction to SIEM
- Network Threats
- SIEM Architecture
- SIEM Deployment
- Logs and Events
- Event Collection and Event Correlation
- Correlation Rules
- Forensically Ready Data
- Intrusion Detection, Prevention and Tolerance
- Properties of a Robust SIEM
- Installing Alien Vault SIEM
- Using Web Interface
- Configuring Sensor, Logger and Server
- onfiguring Network Inventory
- Configuring Vulnerability Scanning
- Configuring Signature Updates
- Policy Management
- Configuring Tickets
- Introduction to SPLUNK
- Overview of machine data
- How Splunk works with machine data
- Introduction to Splunk's user interface
- Searching and saving results
- Creating reports and visualizations
Programme scope, delivery arrangements and suitability are confirmed during enquiry.