ArcSight Logger Administration and Operations H0DW8S

Transcription

1 HP Education Services course data sheet ArcSight Logger Administration and Operations H0DW8S Course Overview ArcSight Logger Administration and Operations provides you with comprehensive training to quickly configure your Logger Appliance or Downloadable Software Logger and bring it into an operational state. Learning content is specifically intended for team members of security operations, network operations, auditing and compliance. This course includes hands-on training exercises on common functionality and procedures to tailor and maintain ArcSight Logger. Leverage built-in product content out-of-the-box or further optimized to fulfill event search and reporting demands in enterprise security and operations log management environments. Audience Price USD $3,200 Links to local schedules, pricing and registration Course title HP course # Category Duration US/Canada ArcSight Logger Administration and Operations H0DW8S Security 4 days This is a base-level course that provides specific content to perform system administrative and IT integration initial setup tasks for ArcSight Logger Appliance or Software Logger form factors, version 5.3. Additional end-user topics are intended for team members of security operations, network operations, as well as personnel responsible for security auditing and compliance. Prerequisites To be successful in this course, you will have an understanding of: Computer desktop, browser, and file system navigation skills Basic understanding of TCP/IP networking and database concepts Enterprise security experience [highly advantageous] Course objectives At the end of this course, you will be able to: Initialize Logger Appliance or install Software Logger, establish network connection, implement initial Logger storage, retention policy, and event indexing

2 Configure event source device/device groups, event Receivers, Forwarders, Destinations, and supporting security authentication Settings Use the Logger search builder to access unified event search facilities, save search queries as filters, saved searches, scheduled alerts, shared or search group filters Establish and manage Logger user/group controls, specify global login, password, resource authorization and authentication settings, alerts and notification policies Access reporting resources to use pre-built reports, copy and customize reports, create report dashboards, and manage report groups and categories to control distribution and access to report objects and published information Course outline Topics Covered Introduction to Logger Basic features and functionality Logger form factors, models, speeds and feeds Deployment scenarios, use cases Basic architecture and data flow Hardware and software specifications Installing and Initializing Software Logger Software Logger Installation and Configuration Wizards Software Logger Upgrade and Uninstall Logger browser interface login Logger Configuration Settings Devices Event Archives Storage Event Input/Output Alerts Scheduled Tasks Filters Saved Search Search Optimization Peer Loggers Configuration Backup System Maintenance Initializing Logger Appliance Logger Installation and Initialization Installing and initializing Logger 2

3 Storage and Retention Policies Event data indexing Network and Time Protocol settings Appliance Reboot Navigating Logger Logger gauges, menu bar, help/options Navigation and window controls Structure of subtabs, menus, options, etc. Functional content and layout Configuring Event Input and Output Receivers - CEF and raw event data capabilities Forwarders and ESM Destinations Devices and Device Groups Event I/O SSL Certificates System Admin Settings System sub-menu Logs sub-menu Storage sub-menu Security sub-menu Managing Users and Groups User Group Privileges Managing Users and User Groups Managing User Authentication User Login Banner Search Tools Customizing Time Ranges Customizing Fields Sets Search Helper Creating Complex Queries using Search Builder Raw Events and Regex Helper Validating Queries with Search Analyzer Pipeline Operators Refining and Rerunning Searches Exporting Search Results Live Event Viewer Reporting Functions Types of Reports Viewing Reports Report Task Options Running Reports 3

4 Publishing and ing Report Results Scheduling Report Jobs Report Administration Generating Reports Search Queries vs. Report Queries Creating and Editing Queries for Reports Using the SQL Editor Report Query Field Attributes and Properties Parameters and Parameter Groups Alerts and Notifications Configuring Notification Destinations Configuring Realtime Alerts and Notifications Viewing Alerts Exporting Alerts Event Search Search UI and term input Search results display Keyword (full-text) search Field (CEF) search Pipeline Operator/Regular Expression Indexing Filters, Saved Searches and Scheduled Alerts Saving and Retrieving a Query Types of Filters Managing Filters Creating Saved Search and Scheduled Alert Jobs Saving and Exporting Search Results Searching from the ESM Console Designing Reports Copying and Editing Reports Using the Ad hoc Report Designer Editing a report from its results display page Customizing a report layout using the Ad hoc Template Configuration Report Dashboards Dashboards and Report Home Pages Creating a Dashboard Creating widgets Setting widget properties Adding Widgets to the dashboard layout Setting dashboard preferences Editing and saving a dashboard 4

5 Import, Export, Backup and Restore Import and Export Logger alerts and queries Backup and Restore Logger reports and configuration Archiving Events Retrieving Audit Error Logs Learn more at hp.com/us/training/americas Copyright 2015 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. H0DW8S Ver A.00 c August 2015