Access Trainingf
or Customers/Partners
Access Training
for NetWitness Employees
This is an Instructor Led Training class, for On-Demand/Self-Paced please click here
Summary
This course provides recommended methodologies for creating content to assist you in discovering, analyzing and resolving threats in the NetWitness Platform.
This is an update to version 11.6.
Overview
This course provides an overview of the type of content available in the NetWitness Platform, including why, when and how to use it. It describes recommended methodologies for creating content and testing the efficacy of the content for use in threat detection.
Audience
Anyone interested in creating content in NetWitness to highlight and discover potential threats
Duration: 2 days
Prerequisite Knowledge/Skills
NetWitness Platform Foundations
Course Objectives
Upon completion of this training, the learner should be able to:
- Identify what content to use when
- Describe the data model and process flow
- Describe how to optimize content for increased performance and results
- Create various types of content
- Create content from LIVE and other sources, such as STIX feeds
- Create content using a recommended process
- Create an alert taxonomy
- Create content for business context
- Use reports to test the efficacy of rules
- Create content for current threats
- Whitelist normal traffic and false positives
- Monitor the performance of alerts and parsers
Course Outline
Module 1: Content Overview
Module 2: Creating Content
Module 3: Deploying Content from Other Sources
Module 4: Content Creation Techniques
