Symantec Security Information Manager 4.5

start > courses and registration > training feature sheet

code.

SEC-MGR

length.

3 days

type.

Instructor-Led

partner.

Symantec :: Veritas

price.

$2,100

The Symantec Security Information Manager 4.5 course is designed for security professionals and network security administrators who are tasked with proactively identifying, prioritizing, and resolving critical security incidents to reduce security risk and become compliant with regulations, such as HIPAA, Graham-Leach-Bliley, and so on.

This course delivers an overview of the Symantec Security Information Manager 96xx Series appliances and the Information Manager console, including details about the components, architecture, features, and benefits.

Students will learn how to deploy and install the product in an enterprise environment, with emphasis on configuration, rule creation, modification, and management of incidents. This course concentrates on how to use Symantec Security Information Manager to reduce security risk by managing security events using built-in or third-party help desk functions.

There are currently no scheduled dates for this course. If you are interested in this course, request a course date with the links below.

who can benefit

This course is for security professionals or network security administrators who are tasked with proactively identifying, prioritizing, and resolving critical security incidents.

prerequisites

You should have a working knowledge of networking, including typical security components such as firewalls, intrusion detection systems, antivirus systems, and so on. Familiarity with the operation of a help desk in an Information Technology environment is also beneficial.

skills gained

By the end of this course, you should be able to:

	Describe the features and benefits of Symantec Security Information Manager.
	Set up the Symantec Security Information Manager appliance.
	Configure Symantec Security Information Manager components for real-world use.
	Create, modify, and manage correlation and event filtering rules.
	Manage incidents, help desk tickets, and reports.

hands-on

This course includes hands-on lab exercises that enable you to test your new skills and begin to transfer them into your working environment.

course content details

	Introduction to the Symantec Security Information Manager

	Overview of Symantec Security Information Manager (SSIM)
	Comparing Symantec Security Information Manager Appliances
	Concepts of Collection, Correlation, Normalization, Filtering, and Event Aggregation
	Connectivity with Symantec and Third-Party Collectors

	Introduction to the Information Manager Console

	Walkthrough of the Information Manager Console
	How a Help Desk Team Facilitates a Proactive Response
	Symantec DeepSight Integration
	How the Console Helps Organizations Maintain Compliance

	Deployment Planning

	SSIM Components and Design Architecture
	Deployment Guidelines in Basic Network Situations

	Installation

	Overview of the SSIM Installation Process
	Exploring the VMware Virtual Lab Environment
	Connecting from the Console to the Appliance
	Installing the SSIM Windows-Based Information Manager Console
	Verifying Connectivity Between the Appliance and the Console

	Configuration

	Performing Basic Configurations of the SSIM System
	Installing and Enabling the Symantec Event Manager Collector
	Adding and Enabling Filtering Rules
	Configuring Event Aggregation
	Configuring SSIM for Automatic Identification and
	Prioritization of Security Threats
	Creating a Help Desk Team and Configuring Ticket Handling

	An Incident Life Cycle

	Walkthrough of an Incident Life Cycle
	Examining Several Standard Activities when Managing Incidents
	Creating an Event Filter for a Host
	Creating, Assigning, and Managing a Help Desk Ticket

	Creating and Using a Help Desk Team

	Help Desk Functions and Workflow Within Information Manager
	Aligning and Integrating Incident Response with IT Help Desk Operations

	Assets

	What Are Assets?
	Attributes of Assets, Creating Assets
	How Assets Are Used to Correlate Incidents

	Collectors

	Types of Collectors
	Components of an Event Collector
	Event Flow and the ICE Model
	Installing Collectors
	Configuring Collectors

	Rules

	Rules and Their Purpose
	Using the Rules Editor
	Specific Rules for Specific Purposes
	Establishing the Right Rule Set for Your Business

	Security Monitoring

	Using the Information Manager's Real-Time Dashboard
	Configuring Alerts to Ensure Business Continuity
	How Global Intelligence Sources and ThreatCon
	Levels Help to Gauge Risk
	Examining Key Metrics and Performance Monitoring

	Reporting

	Using Built-In Queries and Reports
	Modifying an Existing Report
	Creating a Custom Report
	Report Management: Saving, Exporting, Importing,
	Printing, and Publishing Reports
	Creating Specific Reports for Specific Audiences

	System Maintenance

	Overview of Event Archiving and Storage for Regulations Compliance
	LDAP Backup and Restore
	Direct Attached Storage
	How Log Consolidation Enables Regulatory Compliance
	Scheduling and Launching a Database Purge
	Manual and Scheduled Database Backup and Restore
	Load Balancing and Server Clustering Concepts