Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
Open-Source SIEM Sovereignty
- Understanding why cloud-based SIEMs create compliance and cost risks for log retention.
- Wazuh architecture: server, indexer, dashboard, and agents.
- Comparison with Splunk, Sentinel, Elastic Security, and QRadar.
Deployment and Architecture
- Single-node and distributed deployment patterns.
- Docker Compose and Kubernetes manifests.
- Hardware sizing considerations: CPU, RAM, and disk IOPS for log ingestion.
- Certificate and TLS configuration for component communication.
Agent Management
- Installing agents via packages, Ansible, or Group Policy Objects (GPO).
- Agent enrollment, key exchange, and group assignment.
- Agentless monitoring via syslog, AWS S3, or API polling.
- Strategies for upgrading agents across large fleets.
Detection Engineering
- Decoders and rules for log parsing and event extraction.
- MITRE ATT&CK mapping for rule categories.
- File integrity monitoring (FIM) and rootkit detection.
- Custom rules using XML and YAML syntax.
- Threat intelligence integration: MISP, VirusTotal, and AlienVault.
Incident Response and Automation
- Active response mechanisms: firewall blocking, account disablement, process termination.
- SOAR integration with Shuffle, n8n, or custom webhooks.
- Alert correlation and multi-stage attack chaining analysis.
- Case management and evidence preservation.
Compliance and Reporting
- PCI-DSS, HIPAA, GDPR, and NIST control mapping.
- Policy monitoring for password strength, encryption, and patching statuses.
- Scheduled report generation and export functionalities.
- Audit trail integrity and tamper detection.
Dashboards and Visualization
- Wazuh dashboard customization and widget creation.
- Grafana integration for advanced visualizations.
- Kibana compatibility for legacy Elastic deployments.
- Executive and operational SOC views.
Maintenance and Scaling
- Indexer shard management and hot-warm-cold archiving strategies.
- Log retention policies and legal hold procedures.
- Disaster recovery and cluster rebuild processes.
Requirements
- Intermediate proficiency in Linux and Windows system administration.
- Understanding of SIEM concepts: correlation, alerting, and log aggregation.
- Experience with the Elastic Stack or OpenSearch.
Audience
- Security operations centers seeking to replace commercial SIEM solutions.
- Compliance teams requiring on-premise log retention capabilities.
- Government agencies needing sovereign threat detection mechanisms.
21 Hours
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 3900 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (2)
The trainer was helpful..
Attila - Lifial
Course - Compliance and the Management of Compliance Risk
Speed of response and communication