SIEM with Tactical Analytics

درباره‌ی این دوره

• SIEM Architecture
  • State of the SOC/SIEM
  • Log Monitoring
  • Logging architecture
  • SIEM platforms
  • Planning a SIEM
  • SIEM Architecture
  • Ingestion techniques and nodes
  • Data queuing and resiliency
  • Storage and speed
  • Analytical reporting
• Service Profiling With SIEM
  • Detection methods and relevance to log analysis
  • Analyzing common application logs that generate tremendous amounts of data
  • DNS
  • HTTP
  • HTTPS
  • SMTP
  • Apply threat intelligence to generic network logs
  • Active Dashboards and Visualizations
• Advanced Endpoint Analytics
  • Endpoint logs
  • Understanding value
  • Adding additional logging
  • Windows filtering and tuning
  • Analyze critical events based on attacker patterns
  • Host-based firewall logs
  • Credential theft and reuse
  • Monitor PowerShell
  • Containers
• Baselining and user Behavior Monitoring
  • Identify authorized and unauthorized assets Identify authorized and unauthorized assets
  • Active asset discovery
  • Passive asset discovery
  • Combining asset inventory into a master list
  • Adding contextual information
  • Identify authorized and unauthorized software
  • Source collection
  • Baseline data
  • Network data (from netflow, firewalls, etc)
  • Monitor logons based on patterns
  • Time-based
  • Concurrency of logons
  • Endpoint baseline monitoring
• Tactical SIEM Detection and Post-Mortem Analysis
  • Centralize NIDS and HIDS alerts
  • Analyze endpoint security logs
  • Augment intrusion detection alerts
  • Analyze vulnerability information
  • Correlate malware sandbox logs with other systems to identify victims across enterprise
  • Monitor Firewall Activity
  • SIEM tripwires
  • Configure systems to generate early log alerts after compromise
  • Post mortem analysis
  • Re-analyze network traffic

گواهینامه‌ی دوره