Hands-On ArcSight Logger Administration and Operations

Course Description

The ArcSight Logger Administration and Operation course provides you with comprehensive training to quickly configure your Logger and bring it into an operational state. Learning content is specifically intended for team members of security operations, network operations, auditing and compliance.

This course includes Hands-On Labs on common functionality and procedures to tailor and maintain the ArcSight Logger appliance. It also include exercises to take advantage of built-in product content to fulfill event search and reporting demands in enterprise log management environments.

Students Will Learn

Initialize Logger, establish network connection, and implement initial Logger storage, retention policy and event indexing.
Configure event source devicesdevice groups, event Receivers, Forwarders, Destinations, supporting security authentication settings, and optional connector management facilities.
Establish and manage Logger usergroup controls, specify global login, password, resource authorization and authentication settings, alerts and notification policies.
Use the Logger search builder to access unified event search facilities, save search queries as filters, saved searches, shared or search group filters.
Access reporting resources to view pre-built reports, copy and customize reports, and manage report groups and categories to control distribution and access to report information.
And More...

Target Audience

This basic course provides you with specific content to perform system administrative and IT integration initial setup tasks for ArcSight Logger. Additional end-user topics are intended for team members of security operations, network operations, as well as personnel responsible for auditing and compliance.

Prerequisites

Computer desktop, browser, and file system navigation skills
TCPIP networking, database concepts and enterprise security experience are highly advantageous

Course Outline

Module 1 - Introduction to Logger
З Basic features and functionality
З Logger models, speeds and feeds
З Deployment scenarios, use cases
З Basic architecture and data flow
З Hardware and software specifications

Module 2 - Initializing Logger
З Logger Installation
З Logging in to Logger
З Setting up initial network connections (NICs)

Module 3 - Deployment Planning
З Setting storage volumes
З Setting retention policy
З Setting storage groups
З Rebooting
З Initial configuration procedures

Module 4 - Navigating Logger
З Logger gauges, menu bar, help/options
З Navigation and window controls
З Structure of subtabs, menus, options, etc.

Module 5 - Logger Configuration Settings
З Devices
З Event Archives
З Storage
З Event Input/Output
З Alerts
З Scheduled Tasks
З Filters
З Saved Search
З Search Optimization
З Peer Loggers
З Configuration Backup
З System Maintenance
З Retrieve Logs
З Content Import

Module 6 - Configuring Event Input and Output
З Receivers - CEF and raw data capabilities
З Forwarders and ESM Destinations
З Devices and Device Groups
З Event I/O SSL Certificates

Module 7 - System Admin Settings
З System sub-menu
З Logs sub-menu
З Storage sub-menu
З Security sub-menu

Module 8 - Managing Users and Groups
З User Group Privileges
З Managing User Groups
З Managing Users
З Managing User Authentication

Module 9 - Searching and Indexing
З Search UI
З Unified Search Facilities
З Wild Cards
З Auto-suggest
З Indexing

Module 10 - Working with Search Queries
З Query Expressions (Filters)
З Time Range
З Field Sets
З Constraints
З Running, Refining and Rerunning Searches

Module 11 - Using Filters and Saved Searches
З Saving and Retrieving a Query
З Types of Filters
З Managing Filters
З Creating Saved Search Jobs
З Saving and Exporting Search Results
З Searching from the ESM Console

Module 12 - Reporting Functions
З Types of Reports
З Viewing Reports
З Report Task Options
З Report Administration

Module 13 - Designing Reports
З Copying and Editing Reports
З Using the Adhoc Report Designer
З Editing a report from its results display page
З Customizing a report layout using the Adhoc Template Configuration

Module 14 - Generating Reports
З Search Queries vs. Report Queries
З Creating and Editing Queries for Reports
З Using the SQL Editor
З Report Query Field Attributes and Properties
З Parameters and Parameter Groups

Module 15 - Using Dashboards
З About Dashboards
З Dashboards and Report Home Pages
З Creating a Dashboard

Module 16 - Alerts and Notifications
З Configuring Notification Destinations
З Configuring Alerts and Notifications
З Viewing Alerts
З Exporting Alerts

Module 17 - Import, Export, Backup, and Restore
З Import and Export Logger alerts and queries
З Backup and Restore Logger reports and configuration
З Archiving Events
З Retrieving Audit and Error Logs
З Updating Logger Software

Module 18 - Logger Connector Appliance
З Logger-SmartConnector Environment
З Types of SmartConnectors commonly used with Logger
З SmartConnector Configuration Properties
З Installing and configuring SmartConnectors
З Built-in Connector Appliance with selected Logger models

Delivery Method

Instructor-Led with numerous Hands-On labs and exercises.

Equipment Requirements
(This apply's to our hands-on courses only)

BTS always provides equipment to have a very successful Hands-On course. BTS also encourages all attendees to bring their own equipment to the course. This will provide attendees the opportunity to incorporate their own gear into the labs and gain valuable training using their specific equipment.

Course Length

4 Days