Training Micro Focus

Training goals dlearning

code: ESM320-70 | version: 7.0

This course provides you with the knowledge required to use advanced ArcSight ESM 7.0 content to find and correlate event information, perform actions such as notifying stakeholders, graphically analyze event data, and report on security incidents. You will familiarize and/or reinforce your understanding of the advanced correlation capabilities within ArcSight ESM that provide a significant edge in detecting active attacks.

This course covers ArcSight security problem solving methodology using advanced ArcSight ESM 6.11 content to find, track and remediate security incidents. During the training, you will use variables and correlation activities, customize report templates for dynamic content, and customize notification templates to send the appropriate notification based upon specific attributes of an event.

Upon successful completion of this course, you should be able to:

  • Navigate ArcSight ESM console and command center to correlate, investigate, analyze and remediate both exposed and obscure threats
  • Construct ArcSight variables to provide advanced analysis of the event stream
  • Develop ArcSight lists and rules to allow advanced correlation activities
  • Optimize event-based data monitors to provide real-time viewing of event traffic and anomalies
  • Design new report templates and create functional reports
  • Find events through the search tools

Audience/Job Roles

This course is intended for:

  • Define their organization’s security objectives
  • Build or use advanced content to correlate, view and respond to those security objectives

Conspect Show list

  1. ESM Overview
  2. ArcSight console
  3. ESM Active Channels
  4. ESM Filters
  5. Data Monitors and Dashboards
  6. Variable Customization
  7. ESM Lists
  8. ESM Rules
  9. Query Viewers Authoring
  10. ESM Reports
  11. Unified Event Search Tools
Download conspect training as PDF

Additional information

Prerequisites

To be successful in this course, you should have the following prerequisites or knowledge:

  • Common security devices such as IDS and firewalls
  • Common network device functions, such as routers, switches, and hubs
  • TCP/IP functions such as CIDR blocks, subnets, addressing, and communications
  • Basic Windows operating system tasks and functions
  • Possible attack activities, such as scans, man in the middle, sniffing, DoS, and possible abnormal activities, such as worms, Trojans, and viruses
  • SIEM terminology, such as threat, vulnerability, risk, asset, exposure, and safeguards
  • Completed the ArcSight ESM Administrator and Analyst ATP course or 6 months experience administering ArcSight ESM
Difficulty level
Duration 5 days
Certificate

The participants will obtain certificates signed by Micro Focus (course completion).

Trainer

Authorized Micro Focus Trainer

Additional informations

Certification at the Certified Solutions Expert (CSE) level is only available with the ILT version of the course. The certification consists of a hands-on exam the last day of the class. The Accredited Software Professional (ASP) level is an online exam that is purchased separately from the course.

  • ArcSight Admin and Analyst ASP
  • ArcSight Advanced Administrator CSE
  • ArcSight Advanced Analyst CSE
  • ArcSight Logger CSE

Other training Micro Focus | ArcSight

Training thematically related

IT Security

Contact form

Please fill form below to obtain more info about this training.







* Fields marked with (*) are required !!!

Information on data processing by Compendium - Centrum Edukacyjne Spółka z o.o.

3600 USD

FORM OF TRAINING ?

 

TRAINING MATERIALS ?

 

SELECT TERM TRAINING

    • General information
    • Guaranteed dates
    • Last minute (-10%)
    • Language of the training
    • English
    • General information
    • Guaranteed dates
    • Last minute (-10%)
    • Language of the training
    • English
Book a training appointment
close

Traditional training

Sessions organised at Compendium CE are usually held in our locations in Kraków and Warsaw, but also in venues designated by the client. The group participating in training meets at a specific place and specific time with a coach and actively participates in laboratory sessions.

Dlearning training

You may participate from at any place in the world. It is sufficient to have a computer (or, actually a tablet, or smartphone) connected to the Internet. Compendium CE provides each Distance Learning training participant with adequate software enabling connection to the Data Center. For more information, please visit dlearning.eu site

close

Paper materials

Traditional materials: The price includes standard materials issued in the form of paper books, printed or other, depending on the arrangements with the manufacturer.

Electronic materials

Electronic materials: These are electronic training materials that are available to you based on your specific application: Skillpipe, eVantage, etc., or as PDF documents.

Ctab materials

Ctab materials: the price includes ctab tablet and electronic training materials or traditional training materials and supplies provided electronically according to manufacturer's specifications (in PDF or EPUB form). The materials provided are adapted for display on ctab tablets. For more information, check out the ctab website.