Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Open-Source SIEM Sovereignty
- The compliance and cost risks associated with cloud SIEMs regarding log retention.
- Wazuh architecture overview: server, indexer, dashboard, and agent components.
- Benchmarking Wazuh against Splunk, Sentinel, Elastic Security, and QRadar.
Deployment and Architecture
- Exploring single-node and distributed deployment strategies.
- Utilizing Docker Compose and Kubernetes manifests for deployment.
- Hardware sizing considerations for CPU, RAM, and disk IOPS in log ingestion.
- Configuring certificates and TLS for secure communication between components.
Agent Management
- Installing agents through packages, Ansible scripts, or Group Policy Objects (GPO).
- Managing agent enrollment, key exchange, and group assignments.
- Implementing agentless monitoring via syslog, AWS S3, or API polling.
- Formulating agent upgrade strategies for large-scale fleets.
Detection Engineering
- Using decoders and rules for efficient log parsing and event extraction.
- Mapping rules to categories using the MITRE ATT&CK framework.
- Implementing File Integrity Monitoring (FIM) and rootkit detection.
- Creating custom rules using XML and YAML syntax.
- Integrating threat intelligence from sources like MISP, VirusTotal, and AlienVault.
Incident Response and Automation
- Executing active responses such as firewall blocking, account disabling, and process termination.
- Integrating SOAR capabilities using Shuffle, n8n, or custom webhooks.
- Correlating alerts and chaining multi-stage attacks.
- Managing cases and preserving digital evidence.
Compliance and Reporting
- Mapping controls to PCI-DSS, HIPAA, GDPR, and NIST frameworks.
- Monitoring policies for password strength, encryption, and patch management.
- Generating and exporting scheduled reports.
- Ensuring audit trail integrity and detecting tampering.
Dashboards and Visualization
- Customizing Wazuh dashboards and creating new widgets.
- Integrating Grafana for advanced data visualization.
- Maintaining Kibana compatibility for legacy Elastic deployments.
- Designing views for executive oversight and operational SOC use.
Maintenance and Scaling
- Managing indexer shards and implementing hot-warm-cold archiving.
- Defining log retention policies and legal hold procedures.
- Planning disaster recovery and cluster rebuilding processes.
Requirements
- Intermediate-level proficiency in Linux and Windows system administration.
- A solid understanding of SIEM concepts, including correlation, alerting, and log aggregation.
- Practical experience with the Elastic Stack or OpenSearch.
Target Audience
- Security operations centers seeking to replace commercial SIEM solutions.
- Compliance teams requiring on-premise log retention capabilities.
- Government agencies in need of sovereign threat detection infrastructure.
Testimonials (1)
The trainer was helpful..
