LogRhythm Central Administration – Novice to Professional

Master LogRhythm Administration: A Comprehensive Course

This LogRhythm Central Administration course is designed for anyone looking to gain expertise in managing a LogRhythm SIEM platform. Whether you're new to LogRhythm or seeking to solidify your skills, this course provides a step-by-step guide to essential administration tasks. Developed by a seasoned Cyber Security Engineer with over 10 years of experience, this curriculum covers everything from foundational concepts to advanced configurations. This course is built to be practical, focusing on the daily routines of a LogRhythm administrator.

Here's a detailed breakdown of what you'll learn:

• LogRhythm Architecture Overview: Understand the core components of the LogRhythm SIEM, its workflow, and log lifecycle. Learn how LogRhythm functions to provide comprehensive security monitoring.
• Data Management: Explore LogRhythm data classifications, common events, and metadata. Gain insights into the LogRhythm data storage architecture for efficient log management.
• Client & Web Console Navigation: Develop a complete understanding of both the LogRhythm client and web consoles, essential for investigation and management.
• Entities Management: Learn to define and manage entities within LogRhythm, including network and host records. Master bulk entity creation using CSV files for streamlined data import.
• List Management: Effectively manage lists within LogRhythm – create, retire, and expire lists for targeted security analysis.
• Knowledge Base Management: Understand the LogRhythm knowledge base architecture and learn how to enable modules for enhanced threat intelligence.
• User Profiles & Permissions: Manage user accounts, roles, and permissions. Learn to assign permissions and limit user access to specific entities for enhanced security.
• System Settings: Configure global risk base priorities, utilize the RBP calculator, and manage global settings and data management. Implement Active Directory synchronization using the True Identity tool for easy user and group identification. Adjust component logging levels, configure service accounts, and manage archive paths.
• Data Masking: Implement data masking techniques to protect sensitive information within live logs. Understand when and how to apply data masking in various security scenarios.
• Global Log Processing Rules (GLPR): Learn the purpose and creation of GLPRs to efficiently process and normalize log data.
• Client Console Investigation: Master log investigation techniques within the client console, including creating graphs, using the tail command for real-time log monitoring, and building personalized dashboards.
• Report Center: Create custom report templates and report types. Generate sample reports, package reports, schedule report packages, and integrate with Grafana for advanced visualization.
• Second Look Wizard & Archive Utility: Restore logs using the Second Look Wizard and the powerful LogRhythm archive utility – a crucial skill for incident investigation and data recovery.
• System Monitor: Deploy and configure system monitor agents. Initiate smart responses using system monitor agents to proactively address security events.
• Log Source Integration: Gain a comprehensive overview of supported LogRhythm log sources. Integrate Windows, Linux, web server, and database logs. Learn about bulk log source integration and log source virtualization for scalable log collection.
• Advanced Intelligence Engine (AI Engine): Explore the AI Engine and its configurations. Understand rule block types, create new use cases, modify existing use cases, and execute smart responses from the AI Engine.
• Alarm Rules: Understand the difference between alarm rules and AI Engine rules. Enable and test alarm rules to detect and respond to security threats.
• Custom Dashboard Creation: Build custom dashboards with multiple widgets. Customize widgets using Lucene queries to tailor dashboards to specific needs.
• Alarm Management: Effectively manage alarms, investigate alerts, and link multiple alarms for comprehensive incident analysis.
• Case Management: Learn to create and manage security cases. Add collaborators, set priorities, track status, and manage case workflows. Understand case resolution procedures.
• Database Management: Automate database backups and set up database cleanup jobs to ensure data integrity and efficient storage.
• Threat Intelligence: Install and configure threat intelligence tools. Enable the threat intelligence module and associate it with lists for enhanced threat detection.
• Configuration Assessment & Health Check: Perform comprehensive assessments and health checks of LogRhythm integrated log sources, MPE rules, and the AI Engine. Utilize the LogRhythm diagnostic tool to monitor component health.

This course equips you with the knowledge and skills to effectively administer a LogRhythm SIEM, ensuring a robust and secure environment.