Description
The Course Name: CSSOW – Cisco StealthWatch Solution Overview Workshop
The Duration: 2 Days
The Overview:
The purpose of this course is to teach participants the role of NetFlow in network telemetry Position different components of Cisco StealthWatch solution and also the threat detection and incident response processes
What You Will Learn:
Understand the role of NetFlow in network telemetry Position different components of Cisco StealthWatch solution
Understand the threat detection and incident response Processes
The Course Index:
Module 1: Network Telemetry
- The Need for Network Telemetry
- NetFlow Fundamentals
- NetFlow Security Event Logging (NSEL)
Module 2: Architecture and Components of Cisco StealthWatch
- StealthWatch Architecture
- Required Components and Licenses
- Flow Collector
- StealthWatch Management Console (SMC)
- Flow License
- Optional Components and Licenses
- Flow Sensor
- UDP Director
- Threat Intelligence License
- Proxy License
- Identity Integration
- Cloud License
- Endpoint Concentrator
- Learning Network License
- Security Packet Analyzer
Module 3: Design Guidance
- Sizing the Solution
- StealthWatch High Availability Design
- Enterprise Tree and Host Groups
Module 4: Detecting Threats
- Anomaly Detection Model
- Security Events
- Alarm Categories
- Threat Hunting
- İncident Response
- Documentation
Labs
Lab 1: The WebUI
Lab 2: The Swing Client
Lab 3: Inspecting Host Group setup
Lab 4: Performing Flow Queries
Lab 5: Using Documents
Lab 6: Confirming the parameters of a rule/policy
Lab 7: Investigating an Alarm
Lab 8: Copyright Infringement Event
Lab 9: Verify Cisco TrustSec Implementation
Lab 10: Malware Investigation