Micro Focus ArcSight ESM Advanced

• Basic knowledge of cybersecurity concepts and SIEM (Security Information and Event Management) fundamentals
• Prior experience with Micro Focus ArcSight ESM

Audience

• Security analysts
• Cybersecurity and IT professionals

Micro Focus ArcSight ESM (Enterprise Security Manager) is a comprehensive security information and event management (SIEM) solution designed to help organizations detect, analyze, and respond to cybersecurity threats and incidents in real-time.

This instructor-led, live training (online or onsite) is aimed at advanced-level security analysts who wish to elevate their skills in utilizing advanced Micro Focus ArcSight ESM content to improve an organization's ability to detect, respond, and mitigate cyber threats with greater precision and speed.

By the end of this training, participants will be able to:

• Optimize the use of Micro Focus ArcSight ESM to enhance monitoring and threat detection capabilities.
• Construct and manage advanced ArcSight variables to refine event streams for more precise analysis.
• Develop and implement ArcSight lists and rules for effective event correlation and alerting.
• Apply advanced correlation techniques to identify complex threat patterns and reduce false positives.

Format of the Course

• Interactive lecture and discussion.
• Lots of exercises and practice.
• Hands-on implementation in a live-lab environment.

Course Customization Options

• To request a customized training for this course, please contact us to arrange.

Introduction to ArcSight ESM

• Overview of SIEM and ArcSight ESM
• Understanding the ArcSight ESM architecture

Configuring ArcSight Connectors

• Types of ArcSight connectors and their purposes
• Installing and configuring ArcSight connectors
• Managing connector updates and health

ArcSight ESM Management

• Navigating the ArcSight Console
• Managing users, groups, and permissions
• Configuring network and device resources

Correlation Rules and Security Monitoring

• Basics of correlation rules and their creation
• Deploying correlation rules for real-time threat detection
• Utilizing the dashboard for security monitoring

Reporting and Visualization

• Creating custom reports for security analytics
• Designing effective dashboards and visualizations
• Best practices for reporting and alerting

Active Lists, Session Lists, and Data Monitors

• Introduction to lists and data monitors in ArcSight
• Configuring and managing lists for dynamic threat detection
• Practical applications of data monitors

Tool Optimization

• Customizing dashboards for enhanced operational visibility
• Streamlining event streams for efficient monitoring and analysis

Advanced Variable Construction and Developing Lists and Rules

• Techniques for creating complex variables in ArcSight
• Using variables to filter and refine event data
• Developing and managing lists for dynamic event categorization
• Creating advanced rules for automated threat detection and response

Advanced Correlation Techniques and Search Methods

• Strategies for correlating disparate event data to uncover sophisticated threats
• Applying advanced correlation for real-world threat scenarios
• Leveraging ArcSight's search capabilities for deep-dive investigations and threat hunting
• Tips and tricks for constructing effective search queries

System Maintenance and Troubleshooting

• ArcSight ESM backup and restore procedures
• Monitoring system performance and troubleshooting common issues
• Best practices for ArcSight ESM maintenance

Summary and Next Steps