Course Description

In this introductory course learners use the ArcSight console and ArcSight Command Center user interfaces to monitor security events, configure ESM, and manage users and as well as ESM network intelligence resources. Using ArcSight ESM workflow, participants isolate, document, escalate, and resolve security incidents.

The hands-on labs for this course use ESM version 7.0 patch 1

Audience/Job Roles

This course is intended for ESM System Administrators or Analysts

Course Objectives

Upon successful completion of this course, you should be able to:

 Make ArcSight ESM operational upon initial installation

 Describe how ESM works in the context of your network

 Create user accounts

 Implement built-in content

 Populate ESM with your network and assets to identify endpoints involved in an event

 Create site-specific business-oriented views

 Investigate, identify, analyze, and remediate exposed security issues

 

 Use workflow management to provide real-time incident response and escalation tracking

 Modify and run standard reports to provide situational awareness and network status

 Establish ESM peering across multiple ESM instances

 Perform distributed event search and content management

Prerequisites/Recommended Skills

To be successful in this course, you should have the following prerequisites or knowledge:

 Working knowledge of enterprise security, event and log management