Description

This course provides a rigorous hands-on approach to the overall administrative and operation aspects of the RSA enVision product. Students learn the essentials of the product architecture, event capture, analysis environment, and the details involved in setting up system analysis, alerts and comprehensive reports. Students who successfully complete this course will be capable of administering their RSA enVision appliance and performing basic forensic analysis of the network, server, and security events collected by it.

At the end of this course students will be able to:

• Explain the basic architecture and integration of RSA enVision in an enterprise environment
• Describe the management functions used for establishing data sources and gathering network data and events
• Establish parameters for data queries and to retrieve data for analysis and reporting
• Establish system alert triggers and functions

Who Should Attend

Security professionals and administrators who want the capability to administer new device support, is involved in system monitoring and security compliance, or needs to produce reports and analysis of gathered system data.
This course is a prerequisite to the Universal Device Support Development (EUDSD) course.

Certification

Upon completion of this course students will receive a certificate of completion.
Students may elect to take the online RSA enVision Certified Systems Engineer (CSE) exam in passing will become an RSA enVision CSE.

Major Topics

• Introduction and explanation/tour of the management GUI 
• Architecture 
  • primary components and 
  • multiple appliance configuration 
• Accessing historical data for reporting on compliance, policy and audit 
• Define and refine data query functions and data retrieval parameters 
• Report generation functions 
  • comprehensive system data views 
  • scheduling and 
  • storage management reporting 
• Advance reporting 
  • customized formatting and 
  • graphical analysis 
• Real-Time Security Analysis establishing alerts based on defined levels and specific events 
• Triggering alerts through correlation of events or sequence of events 
• Enterprise Dashboard use for basic functions and system monitoring