This course primarily focus on Security Information and Event Management (SIEM) architecture and process, by navigating the candidate through the steps of deploying a SIEM in Security Operations Center (SOC) integration.
This program further covers many bases in the "appropriate" use of a SIEM platform to enrich readily available log data in enterprise environments and extract actionable intelligence.
This training program also designed to provide individuals training, methods, and processes for enhancing existing logging solutions. In addition, provide candidates with an understanding of the various data sources form where logging systems collect vast amounts of data for proper analysis.
Once collected, the participants will be shown how to present the gathered input into useable formats to aid in eventual correlation. Participants will then iterate through the log data and events to analyze key components that will allow them to learn how rich this information is, how to correlate the data, start investigating based on the aggregate data, and finally, how to go hunting with this newly gained knowledge. They will also learn how to deploy internal post-exploitation tripwires.
In addition, this course will also focus on about cybersecurity blue and red teams’ concepts and emphases on building the skills necessary to create your own teams for effectively collection and analysis data to defend your organization against threat actors.
The training program is ideal for those working in positions such as, but not limited to -
IT Manager, Network Manager, Security Manager, Site Administrator, Network Administrator, Technical Support Engineer, Systems Engineer System Administrators, Cyber Threat Investigators or any Individuals working to implement Continuous Security Monitoring or Network
