Open Source/Security Incidents and Event Management with QRadar (Foundation)

Overview Schedule & Fees Course Benefits Student Feedback FAQ Course Modules

Security Incidents and Event Management with QRadar (Foundation) Certification Training Course Overview

QRadar SIEM offers deep insight into network, user, and application activity. It provides collection, normalization, correlation, and secure storage of events, flows, assets, and vulnerabilities. Suspected alleged attacks and policy breaches are highlighted as offenses. In this course, one learns to traverse the user interface and investigate offenses. Participants are trained to search and analyze the information from which QRadar SIEM concludes a suspicious activity. Hands-on exercises reinforce the skills learned.

Audience: The course is meant for:

Security Analysts
Security Technical Architects
Offense Managers
Network Administrators
System Administrators

Security Incidents and Event Management with QRadar (Foundation) (16 Hours) Download Course Contents

Live Virtual Classroom Fee On Request

Group Training 15 - 16 Nov GTR 09:00 AM - 05:00 PM CST (8 Hours/Day)	1-on-1 Training (GTR) 4 Hours 8 Hours Week Days Weekend Start Time : At any time 12 AM 12 PM Training Schedule: GTR=Guaranteed to Run

Special Solutions for Corporate Clients! Click here

Hire Our Trainers! Click here

Customers who bought this course also bought

Advanced Linux BASH Shell Scripting Training Course

Advanced DevOps Training Course

Advanced Docker Concepts and Container Orchestration Training

Terraform Certification Training Course

Introduction to Docker Kubernetes and OKD Course

Kubernetes Administration Using Docker Training Course

Perl Programming Training Course

Python Bootcamp Certification Training Course

Security Information and Event Management SIEM Certification Training Course

System and Network Security Introduction Training Course

10% discount on 2nd course:

Course Modules

Module 1: Introduction to IBM Security QRadar SIEM

Purposes of QRadar SIEM
QRadar SIEM and the IBM Security Framework
Identifying suspected attacks and policy breaches
Providing context
Key QRadar SIEM capabilities
QRadar SIEM Console

Module 2: How QRadar SIEM collects security data

Normalizing log messages to events
Event collection and processing
Flow collection and processing
Reporting
Asset profiles
Active scanners
QRadar Vulnerability Manager scanner
Gathering asset information

Module 3: Using the QRadar SIEM dashboard

Navigating the Dashboard tab
Dashboard overview
Default dashboard
QRadar SIEM tabs
Other menu options
Context-sensitive help
Dashboard refresh
Dashboard variety
Creating a custom dashboard
Managing dashboard items

Module 4: Investigating an offense that is triggered by events

Introduction to offenses
Creating and rating offenses
Instructor demonstration of offense parameters
Selecting an offense to investigate
Offense Summary window
Offense parameters
Top 5 Source IPs
Top 5 Destination IPs
Top 5 Log Sources
Top 5 Users
Top 5 Categories
Last 10 Events
Last 10 Flows
Annotations
Offense Summary toolbar
Lesson 4 Acting on an offense
Offense actions
Offense status and flags

Module 5: Investigating the events of an offense

Navigating to the events
List of events
Event details: Base information
Event details: Reviewing the raw event
Event details: Additional details
Returning to the list of events
Filtering events
Applying a Quick Filter to the payload
Using another filter option
Grouping events
Grouping events by low-level category
Removing grouping criteria
Viewing a range of events
Monitoring the scanning host
Saving search criteria
Event list using the saved search
About Quick Searches
Using alternative methods to create and edit searches
Finding and loading a saved search
Search actions
Adding a saved search as a dashboard item
Saving a search as a dashboard item
Enabling time-series data
Selecting the time range
Displaying 24 hours in a dashboard item
Modifying items in the chart type table

Module 6: Using asset profiles to investigate offenses

About asset profiles
Creating asset profiles
Navigating from an offense to an asset
Assets tab
Asset summary
Vulnerabilities

Module 7: Investigating an offense that is triggered by flows

About flows
Network Activity tab
Grouping flows
Finding an offense
Offense parameters
Top 5 Source and Destination IPs
Top 5 Log Sources
Top 5 Categories
Last 10 Events
Last 10 Flows
Annotations
Base information
Source and destination information
Layer 7 payload
Additional information
Creating a false positive flow or event
Tuning a false positive flow or event

Module 8: Using rules and building blocks

About rules and building blocks
About rules
About building blocks and functions
Navigating to rules
Finding the rules that fired for an event or flow
Finding the rules that triggered an offense
Rule Wizard demonstration
Rule Wizard
Rule actions
Rule response

Module 9: Creating QRadar SIEM reports

Reporting introduction
Reporting demonstration
Reports tab
Finding a report
Running a report
Selecting the generated report
Viewing a report
Reporting demonstration
Creating a new report template
Choosing a schedule
Choosing a layout
Defining report contents
Configuring the upper chart
Configuring the lower chart
Verifying the layout preview
Choosing a format
Distributing the report
Adding a description and assigning the group
Verifying the report summary
Viewing the generated report
Best practices when creating reports

Module 10: Performing advanced filtering

Filtering demonstration
Flows to external destinations
Remote to Remote flows
Scanning activity
Applications not running on the correct port
Data loss
Flows to suspect Internet addresses
Filtering on custom rules and building blocks
Grouping by custom rules
Charts on Log and Network Activity tabs: Grouping
Charts on Log and Network Activity tabs: Time range
Capturing time-series data
Viewing time series charts: Zooming to focus

Download Course Contents

Request More Information

Request a call back?

Course Prerequisites

Basic Netwrok and Server administration Knowledge.

Upon Completion of this Course, you will accomplish following:-

Describe how QRadar SIEM collects data to detect suspicious activities
Navigate and customize the QRadar SIEM dashboard
Investigate suspected attacks and policy breaches
Search, filter, group, and analyze security data
Investigate the vulnerabilities and services of assets
Locate custom rules and inspect actions and responses of rules
Use QRadar SIEM to create reports
Use charts and apply advanced filters to examine specific activities in your environment

Give an edge to your career with Cyber Security certification training courses. Students can join the classes for Security Incidents and Event Management with QRadar (Foundation) Training & Certification Course at Koenig Campus located at New Delhi, Bengaluru, Shimla, Goa, Dehradun, Dubai & Instructor-Led Online.