RSA NetWitness
0(0 Ratings)
Requirements
- Learners should have a basic understanding of cybersecurity concepts and tools, including SIEM systems, network security monitoring (NSM) tools, incident response procedures, common cybersecurity threats and attack vectors, and basic networking concepts.
Target Audience
- Anyone can go with this course.
About Course
RSA NetWitness is a security information and event management (SIEM) tool used for threat detection and response.
It provides real-time visibility into network activity, logs, and events from various sources, including network devices, servers, and endpoints.
What I will learn?
- RSA NetWitness Platform is designed to identify and respond to advanced threats that may go unnoticed by traditional security measures.
- It uses behavioural analysis, machine learning, and threat intelligence to detect and respond to threats in real-time.
- RSA NetWitness also provides advanced reporting and visualization capabilities, allowing security teams to analyze and investigate security incidents quickly.
Course Curriculum
RSA NetWitness Platform Overview
-
RSA NetWitness Platform components and architecture
00:00 -
RSA NetWitness Data
00:00 -
RSA NetWitness Interface
00:00
Investigation Basics
-
What is metadata?
00:00 -
Differentiating between packets and logs
00:00 -
Differentiating between data and metadata
00:00 -
Customizing the investigation screens
00:00 -
Viewing reconstructed events
00:00 -
Writing simple and complex queries
00:00 -
Describing the purpose of meta key indexing
00:00 -
Customizing data and metadata displays
00:00 -
Creating data visualizations
00:00 -
Creating meta groups
00:00 -
Creating custom column groups
00:00 -
Using complex queries, drills and views to perform investigations
00:00 -
The Context Hub
00:00
Refining the Dataset
-
Filtering data with rules
00:00 -
Taxonomy concepts for metadata
00:00 -
Using Application rules to create new meta
00:00 -
Using Correlation rules to create new meta
00:00 -
Deploying content from RSA Live to create new meta
00:00 -
Describing how parsers populate meta keys
00:00 -
Creating feed
00:00 -
Using alerts and metadata to investigate potential threats
00:00
Reporting and Alerting
-
Configuring the Reporting Engine and RESPOND
00:00 -
Creating reports
00:00 -
Creating alerts to identify future threats
00:00 -
Event Stream Analysis
00:00 -
Configuring ESA
00:00 -
Creating ESA alerts
00:00 -
Best practices and approaches
00:00
Incident Management and Respond
-
Components of the RESPOND module
00:00 -
Viewing alerts and incidents
00:00 -
Incident Rules
00:00
Endpoint Insights Agent
-
Insight configurations
00:00 -
Endpoint investigation
00:00 -
Hots/Files
00:00
UEBA Concepts
-
How UEBA works
00:00 -
Analyzing logon activity
00:00
Student Ratings & Reviews
No Review Yet
Student Ratings & Reviews
No Review Yet