Arcsight

This curriculum reflects the scope typically addressed across a full consulting engagement or multi-phase internal transformation initiative.

Module 1: Threat Landscape and Use Case Prioritization

• Evaluate emerging threat vectors (e.g., ransomware, insider threats, cloud-native attacks) to determine relevance to organizational assets and risk profile.
• Map MITRE ATT&CK techniques to business-critical systems to identify high-impact detection opportunities.
• Assess false positive rates and alert fatigue implications when selecting initial use cases for deployment.
• Balance detection sensitivity with operational capacity by calibrating thresholds based on available SOC staffing and escalation paths.
• Align use case development with compliance mandates (e.g., PCI-DSS, SOX) to satisfy audit requirements without overburdening monitoring scope.
• Prioritize use cases using a risk-weighted model that factors in exploit likelihood, asset criticality, and detection feasibility.
• Integrate threat intelligence feeds to dynamically adjust detection logic based on observed adversary behavior in peer industries.
• Define escalation playbooks for high-severity alerts to ensure timely response without over-alerting to low-fidelity indicators.

Module 2: ArcSight Architecture and Deployment Models

• Compare on-premises, hybrid, and cloud-hosted ArcSight deployments in terms of data residency, latency, and operational control.
• Size ESM (Enterprise Security Manager) and Logger components based on EPS (events per second) projections and retention requirements.
• Design high-availability configurations for ESM nodes to maintain correlation continuity during system outages.
• Evaluate network segmentation and firewall rules required to secure ArcSight component communication (e.g., SmartConnectors to ESM).
• Assess scalability limits of SmartConnector types under peak load and implement load balancing or tiered forwarding.
• Implement data partitioning strategies in Logger to manage query performance across multi-tenant or business-unit environments.
• Plan for disaster recovery by defining backup frequency, log replication intervals, and RTO/RPO targets for metadata and event data.
• Integrate ArcSight with existing identity providers using SAML or LDAP to enforce role-based access consistently.

Module 3: Log Source Onboarding and Normalization

• Select log sources based on risk coverage, compliance obligations, and forensic utility in incident investigations.
• Configure SmartConnectors to handle protocol variations (e.g., Syslog, SNMP, API polling) and handle intermittent connectivity.
• Validate CEF (Common Event Format) mapping accuracy to ensure fields like deviceAction, destinationAddress, and outcome are consistently populated.
• Address timestamp discrepancies across time zones and clock skew to maintain accurate event sequencing.
• Implement parsing rules for non-standard log formats and assess performance impact on connector CPU utilization.
• Manage log source lifecycle including version upgrades, deprecation, and revalidation after system changes.
• Monitor log source health using connector status dashboards and automate alerts for prolonged silence or parsing failures.
• Balance normalization depth with performance by deciding which custom fields to extract versus leaving in raw form.

Module 4: Correlation Rule Design and Tuning

• Construct stateful correlation rules using temporal windows to detect multi-stage attack patterns (e.g., reconnaissance, lateral movement).
• Set rule thresholds to minimize false positives while maintaining sensitivity to low-frequency, high-risk behaviors.
• Use rule chaining to escalate alerts based on cumulative evidence rather than isolated events.
• Implement suppression logic to exclude expected or authorized activity (e.g., patching windows, penetration tests).
• Measure rule efficacy using precision, recall, and mean time to validate across retrospective data sets.
• Version-control correlation rules to track changes, enable rollback, and support audit reviews.
• Coordinate rule updates with change management processes to prevent unintended outages or performance degradation.
• Document rule assumptions, expected triggers, and known bypass methods for SOC analyst reference.

Module 5: Real-Time Monitoring and Incident Triage

• Design ESM dashboards that prioritize visibility into high-risk assets, top alert categories, and geographic threat origins.
• Configure active lists to track dynamic indicators (e.g., known-bad IPs, privileged user sessions) for real-time correlation.
• Set alert severity levels based on business impact, exploit maturity, and asset criticality rather than event volume.
• Integrate ArcSight alerts with ticketing systems (e.g., ServiceNow) using bi-directional synchronization to track resolution status.
• Define triage workflows that assign alerts to analysts based on expertise, shift schedules, and workload balancing.
• Implement alert deduplication strategies to reduce analyst overhead without losing contextual event bundles.
• Use case management fields to record investigation steps, evidence, and escalation decisions for audit and review.
• Monitor analyst response times and alert backlog to identify staffing gaps or process bottlenecks.

Module 6: Threat Hunting and Advanced Analytics

• Construct AQL (ArcSight Query Language) queries to identify anomalies in user behavior, such as off-hours access or excessive failed logins.
• Compare baseline activity patterns across user groups and devices to detect deviations indicative of compromise.
• Use historical log data in Logger to reconstruct attack timelines during post-incident analysis.
• Integrate UEBA (User and Entity Behavior Analytics) outputs with ESM to prioritize high-risk user cases.
• Validate hunting hypotheses against control groups to avoid overfitting to noise or benign outliers.
• Document hunting playbooks that specify data sources, query logic, expected findings, and follow-up actions.
• Assess computational cost of complex queries to avoid degrading system performance during peak operations.
• Coordinate hunting activities with blue team exercises to test detection coverage and response readiness.

Module 7: Compliance Reporting and Audit Readiness

• Generate recurring reports for regulatory frameworks (e.g., GDPR, HIPAA) that demonstrate log coverage and access controls.
• Validate report accuracy by cross-referencing output with source logs and configuration settings.
• Automate report distribution schedules while enforcing encryption and access controls for sensitive outputs.
• Preserve immutable audit trails of report generation, access, and modification for forensic accountability.
• Map log sources and correlation rules to specific control requirements (e.g., NIST 800-53 AU-2, AU-6).
• Prepare for auditor inquiries by maintaining documentation on log retention, system uptime, and rule validation cycles.
• Use report templates that support both executive summaries and technical drill-downs for different stakeholder levels.
• Adjust reporting scope to avoid disclosing excessive detail that could aid adversarial reconnaissance.

Module 8: Performance Optimization and System Governance

• Monitor EPS ingestion rates and adjust connector configurations or hardware resources to prevent backlog accumulation.
• Identify and decommission unused or redundant correlation rules to reduce processing overhead.
• Optimize AQL queries by indexing frequently searched fields and avoiding full-table scans in Logger.
• Implement retention policies that align with legal requirements and storage capacity constraints.
• Conduct capacity planning reviews every quarter to project growth in log volume and processing needs.
• Enforce change control for ESM configuration updates to prevent unauthorized modifications and ensure rollback capability.
• Track system uptime, alert latency, and query response times to establish performance baselines and SLAs.
• Document system architecture, data flows, and ownership roles to support continuity during staff transitions.

Module 9: Integration with Broader Security Ecosystem

• Configure bi-directional SOAR integration to automate enrichment, containment, and response actions from ArcSight alerts.
• Forward high-fidelity alerts to EDR platforms for host-level investigation and telemetry collection.
• Sync threat intelligence from TIPs to ArcSight active lists or correlation rules using STIX/TAXII protocols.
• Validate API rate limits and error handling when integrating with cloud services (e.g., O365, AWS CloudTrail).
• Map ArcSight events to SIEM-agnostic frameworks like Sigma rules to support tool portability and collaboration.
• Assess data sovereignty implications when routing logs through third-party integration platforms or managed services.
• Use webhooks to trigger external notifications while ensuring payload encryption and recipient authentication.
• Monitor integration health through heartbeat checks and automated failure alerts.

Module 10: Operational Risk Management and Failure Mitigation

• Identify single points of failure in ArcSight architecture and implement redundancy for critical components.
• Simulate log source outages to test failover mechanisms and alerting on data gaps.
• Develop escalation paths for system performance degradation, including temporary rule disabling or data sampling.
• Conduct periodic red team exercises to test detection gaps and validate rule effectiveness against real tactics.
• Review incident post-mortems to identify systemic weaknesses in detection, triage, or response workflows.
• Establish metrics for mean time to detect (MTTD) and mean time to respond (MTTR) to benchmark program maturity.
• Assess skill gaps in analyst teams and align training with tool capabilities and threat evolution.
• Plan for vendor lock-in risks by maintaining exportable rules, queries, and documentation for potential migration.