Detailed Course Outline
Module 1 - Detection Engineering
- Give an overview of ES detections and finding types
- Create Event-based detections using the Detection Editor
- Review the configuration of Finding-based detections
- Highlight the details of Detection Studio
Module 2 - Customizing the Analyst Queue and Findings
- Divide the Analyst Queue into Team-based Queues
- Create and use Views
- Customize the Analyst Queue
- Modify Urgency
- Create new Status values
- Add fields to Finding attributes
- Suppress Findings
- Create ad-hoc Findings
Module 3 - Custom Investigation Tools
- Create Investigation Types
- Design custom Response Plans
- Import/export response plans
- Give an overview of SOAR pairing
- Create Automation Rules to automatically run a playbook when a detection produces findings
Module 4 - Asset & Identity Management
- Review the Asset and Identity Management interface
- Describe Asset and Identity KV Store collections
- Configure and add asset and identity lookups to the interface
- Configure settings and fields for asset and identity lookups
- Explain the asset and identity merge process
- Describe the process for retrieving LDAP data for an asset or identity lookup
- Review User and Entity Behavior Analytics (UEBA) and Exposure Analytics (EA)
Module 5 - Data Normalization
- Understand how ES uses accelerated data models
- Verify data is correctly configured for use in ES
- Validate normalization configurations
- Install additional add-ons
- Ingest custom data in ES
- Describe add-on troubleshooting
Module 6 - Risk-Based Alerting
- Give an overview of Risk-Based Alerting (RBA)
- Explain risk scores and how they can be changed by detections or manually
- Review the Risk analysis dashboard
- Understand Finding-based detections
- Describe annotations
- View risk information in Analyst Queue findings
Module 7 - Managing Threat Intelligence
- Review the Threat Intelligence Framework (TIF) and Threat Intelligence Management (TIM)
- Understand and configure threat intelligence
- Use the Threat Intelligence interface to configure threat lists