-: In this section of the course, 2 2
we're going to dive further into our coverage of SIEMs, 3 3
which, as you know, are the security information 4 4
and event management systems. 5 5
Now, our focus in this section 6 6
of the course is going to continue to be on domain one, 7 7
security operations, as we discuss objective 1.3 along 8 8
with moving into domain 4, 9 9
reporting and communication with objective 4.1. 10 10
Now objective 1.3 states that given a scenario, 11 11
you must be able to use appropriate tools, 12 12
or techniques to determine malicious activity. 13 13
Our specific focus in this section is going to be 14 14
on the security monitoring activities associated 15 15
with SIEMs, of course, inside of this section. 16 16
Objective 4.1 states that you must be able to explain 17 17
the importance of vulnerability management reporting 18 18
and communication, specifically focusing on the use 19 19
of SIEM dashboards as one method of reporting inside 20 20
of our larger vulnerability management program. 21 21
Now, as we move through this section, 22 22
we're going to start out by looking at a SIEM dashboard, 23 23
and how we can use them to monitor our networks. 24 24
Then we're going to be taking a look 25 25
at how you can use a scene to detect 26 26
and analyze various events, 27 27
as well as how to conduct trend analysis 28 28
by detecting issues over time within your networks. 29 29
Next, we're going to look at how rules 30 30
and queries can be written for your SIEMs, 31 31
and even how you can describe 32 32
how to perform various string searches 33 33
using regular expressions, 34 34
while piping data through various command line tools 35 35
on your system through the find that data even quicker. 36 36
Then we're going to be covering the basics of scripting, 37 37
including how to use Bash, WMIC, 38 38
and Powershell to find exactly what you're looking for. 39 39
After that, we're going to analyze, filter, 40 40
and search various event logs to find 41 41
that figurative needle in a haystack, 42 42
while we're trying to identify malicious data 43 43
within our busy networks. 44 44
Finally, we're going to take a short quiz 45 45
to see what you learned during this section of the course 46 46
and review each of those questions fully 47 47
to ensure you can explain 48 48
why the right answers were correct. 49 49
So, let's continue to look at SIEMs, 50 50
and how to use them for our analysis 51 51
during this section of the course.