WPN4-ELK_NetEye Administrator Log Manager (SIEM)

Duration&Format

4 days (20 hours)

Theory and practical exercises using a dedicated training environment for each participant. The training environment is available for 15 days from the start of the course.

Focus

Elastic – Logs, Metrics, and Security

Prerequisites

Participants are expected to have a basic understanding of the Elastic Stack and prior hands-on experience with Kibana.

In particular, participants should be able to:

• describe the main Elasticsearch components and their respective roles at a high level;

• distinguish between indices, data streams, and documents;

• understand the fundamental concepts of mappings and the main field types;

• use Kibana to:

  • navigate through Discover;

  • create and use Data Views;

  • perform basic searches using KQL;

  • apply time-based filters and field filters;

  • access dashboards and visualizations;

• interpret the basic structure of a JSON document;

• understand the difference between logs and security events;

• be familiar with the concepts of log collection and log ingestion.

In-depth knowledge of ECS, ESQL, Lucene, EQL, Query DSL, ingest pipelines, the Transform API, Painless, Elastic Security, or advanced cluster management is not required. These topics will be covered in detail during the course.

Course contents

Course module overview!