on - edited on by
kohe3
Access Training
for Customers/Partners
Access Training
for NetWitness Employees
Summary
Are you an RSA Netwitness customer looking for guidance on ESA? This OnDemand learning will provide you with the right information to get started.
Overview
This On-Demand learning course presents an overview of Event Stream Analysis including a description of correlation approaches and ESA’s role in correlation, ESA components and features, when to use ESA and how configuration settings affect ESA rules. It focuses on the basics of ESA including architecture, creating basic rules, deploying rules, creating enrichments and notifications and forwarding alerts to the RESPOND module.
Audience
Anyone who is interested in Event Stream Analysis (ESA) with relation to the RSA NetWitness Platform.
Delivery Type
On-Demand Learning (self-paced eLearning)
Duration
60 Minutes
Prerequisite Knowledge/Skills
It is recommended that students complete the following eLearning courses prior to taking this training:
Course Objectives
Upon successful completion of this course, participants should be able to:
- Describe a correlation approach
- Describe ESA’s role in correlation
- Describe the features and components of ESA
- Identify when and how to use an ESA rule
- Describe the features of the basic rule builder
- Create a basic rule
- Create enrichments
- Describe how configuration settings affect ESA rules
- Explain the best practices for writing ESA rules
Course Outline
Module 1: A Correlation Approach
Module 2: ESA Overview
Module 3: Basic ESA Rules
Module 4: Configuring ESA
Module 5: ESA Best Practices
