Configuring ArcSight SOAR for Effective Threat Response (CASFETR)

Module 1: Introduction to ArcSight SOAR\n\n\n\n- Challenges Faced by Organizations\n- What Is ArcSight SOAR?\n- ArcSight SOAR Features.\n- Deployment Overview of ArcSight SOAR.\n- Accessing ArcSight SOAR\nModule 2: Setting Up SOAR to Receive Alerts\n\n\n\n- Installing a Forwarding Connector on ESM\n- Configuring a Forwarding Connector User and Web User on ESM\n- Configuring a Pre-persistent Rule to Tag the Events Forwarded to SOAR\n- Adding an ESM Alert Source on SOAR\n- Adding an ESM Integration on SOAR\n\nModule 3: Understanding the SOAR Workflow\n\n\n- Processing ESM Alerts with SOAR\n- Rule Name Filters\n- Classification\n- Consolidation\n- Dispatching Cases\n- Automating Case Handling by Using Playbooks\nModule 4: SOAR Integrations Overview\n\n\n\n- SOAR Integrations Capabilities\n- Use Cases Benefits\n- Integrating SOAR with MISP\n- Integrating SOAR with VirusTotal\nModule 5: SOAR Users, Groups, SSO\n\n\n- Creating User Groups in Fusion\n- Creating Users in Fusion\n- Importing Existing Users from ESM\n- User Roles and Assigning Permissions\n- ACLs in SOAR\nModule 6: SOAR Case Management\n\n\n- Understanding the SOAR Cases User Interface\n- Viewing Case Details\n- Managing Cases in SOAR\nModule 7: Filtering, Classifying, Consolidating, and Dispatching Cases\n\n\n- Filtering Alerts for Case Creation\n- Classifying Cases on SOAR\n- Consolidating Alerts to Create Cases\n- Dispatching Cases\nModule 8: Automating Responses with Workflow Playbooks\n\n\n- What are Playbooks?\n- Working with Playbooks\n- Workflow Playbooks\n- Scheduled Playbooks\n- Managing Triggers\n- Handling Manual Processes Through Tasks\n- Out of The Box Workflows\n- \nModule 9: SOAR System Status\n\n\n- Alerts\n- Action and Rollback Queues\n- Action History\n- Enrichment History\n- Process Queues\n- Troubleshooting\nModule 10: Monitoring Using SOAR Dashboards and Reports\n\n\n- Reports in Fusion\n- ArcSight SOAR Standard Content Resources\n- Scheduling and Exporting Reports\n- Running SOAR Legacy Reports (Jasper Reports)

This course assumes a familiarity working with ArcSight ESM but it is not required

Administrators and Content Engineers responsible for configuring ArcSight security content.

8