Secure Information and Event Management
Description
SIEM explores the concept of, and software solutions associated with Secure Information and Event Management. SIEM provides and organisation with an overall view of what is happening on IT infrastructure in real-time and helps IT teams to be more proactive in the fight against security threats. SIEM is also a recognised industry acronym associated with cybersecurity. This module will examine data collection and forensics, user activity, alert management and reporting giving IT professionals the knowledge to respond quickly and efficiently to cyberattack incidences.
The module also examine cybersecurity best practice implementations around the Mitre ATT&CK Framework and Lockheed Martin’s Cyber Kill Chain Model. Case studies examining the implementation of cybersecurity controls are an essential element of this module.
Learning Outcomes
Explain concepts of SIEM as part of overall cyber security
Apply knowledge of the legal requirements of protecting organisational data
Design effective reports for organisational compliance requirements
Evaluate the tools used for data analytics and visualisation
Evaluate and compare SIEM platforms
Use threat intelligence to understand the risk to organisational data and infrastructure.
Apply matrix solutions for threat hunting
Interpret the organised approaches to manage the aftermath of a security breach or cyberattack
Deploy multiple collection agents to gather security-related events from end-user devices, servers and network equipment