Introduction to SiteProtector

Prerequisites:

A working knowledge of TCP/IP, and Windows 2000 is required.

Course Description:

Internet Security Systems' SiteProtector application provides scalable, centralized security management and data analysis capabilities for Proventía appliances, Proventía Desktop as well as RealSecure Network and Server solutions. SiteProtector simplifies large-scale deployments through cost-efficient, unified command, control and monitoring, thereby reducing security management demands on staff, network traffic or other operational resources. Event prioritization and correlation enable real-time attack and misuse tracking.

The SiteProtector interface helps administrators work more efficiently through flexible views built around asset grouping and event aggregation. Powerful filters screen for event exceptions and false alerts. In addition, SiteProtector automates Proventía and RealSecure deployments, and enables multiple site management via secure remote administration.

The Introduction to SiteProtector training course provides concepts, methods and practices necessary to successfully use the SiteProtector management tool. The course focuses on hands-on exercises supported by demonstrations, presentations, and lecture. Starting with an introduction to the SiteProtector architecture and the different components, students will learn about the role of each component and how they act in concert to monitor and protect a real-world network. Students will learn how to install and configure SiteProtector as well as how to manage sensors and monitor network assets in the SiteProtector environment.

Who Should Attend

Security professionals overseeing, managing or operating any of Internet Security System's solutions.

This course is in preparation for the SiteProtector examination.

This course includes the following modules:

Course Content

• Describing SiteProtector's system architecture and how it integrates data from various network appliances and agents, host-based sensors and agents, and network- and host-based scanners
• Explaining SiteProtector installation options and the different approaches for deploying SiteProtector components on a network
• Performing a Custom SiteProtector installation on multiple computers
• Applying X-Press Updates to SiteProtector components, sensors, and scanners
• Using the SiteProtector Console to monitor security events, and to manage Provent?â¨?a appliances and network, server, and desktop agents
• Using the SiteProtector Web Portal to view the status of SiteProtector assets and monitor security events
• Organizing SiteProtector and network assets to facilitate effective management and analysis
• Importing Active Directory groups and host information into SiteProtector
• Using SiteProtector to run an Internet Scanner vulnerability scan
• Using event analysis best practices
• Using the SiteProtector Reporting Module to generate Site reports
• Configuring SiteProtector components
• Using the SiteProtector Enterprise Dashboard to facilitate trend analysis and generate Enterprise reports
• Configuring SiteProtector Database maintenance settings
• Installing and configuring SiteProtector components: Deployment Manager, Database Server, Application Server, RealSecure Server Sensor, and Internet Scanner (Lab)
• Using the SiteProtector Console to monitor event data, and manage sensors and scanners (Lab)
• Applying X-Press Updates to SiteProtector components, sensors, and scanners (Lab)
• Running a remote vulnerability scan (Lab)
• Creating Analysis views and data filters (Lab)
• Creating a Baseline view (Lab)
• Displaying event detail (Lab)
• Creating incidents and exceptions (Lab)
• Exporting Analysis view data (Lab)
• Generating Site and Enterprise reports (Lab)