Forcepoint Threat Protection for Linux
Seminar / Training Forcepoint Threat Protection for Linux
Memory forensics - Extracting IPs, ports from memory - Garbage dumps - Process-related data structures - Non-default kernel modules
Linux requirements for deployment - Threat protection for Linux - Package formats (RPM, DEB) - SSH with client certificate - Sudo and forced commands - Kernel module management - System log and removal rate - Restricting - Task setting with crontab
Product architecture - Software components and interactions - Kernel module pmad.ko - Reference databases - SIEM and Splunk
Reporting and Splunk - Configuration management tools - Ansible - Cfengine, Salt - Puppet - Chef
Endpoint configurations - Analyzing the full dump - Creating partial queries - Dealing with "blurry" memory images
Command line tools explained - secondlook-cli - secondlook-scan - secondlook-gui
Alert filtering - Regex for alert descriptions
SIEM and Splunk - Collecting data; SIEM and syslogd - Splunk data sources - Splunk queries and dashboards - Integration with GreyLog, ArcSight, QRadar, Datalog, Sumologic
Setting up reference database - Configuring DB, users and permissions
Adding new software to the reference database - Overview of deb, rpm packages - ELF format - Sizing and caching considerations - Secondlook_scan.cfg and URL
Adding new kernel images - Inspecting ZRK files - Creating new reference ZRKs - Adding ZRKs to local reference
Filter warnings - Regex patterns with warning messages - Typical warning examples
Testing - Unrecognized user processes- Non-ELF executable mappings - Experiments with modified longring - Software - Additional drivers - JIT compilation
Promiscuous NICs, pre-linking - VMware tools as false positives - NIC configuration causing warnings - Pre-linking (CentOS and other distributions)
Unrecognized kernel modules - Credential reuse for kernel tasks - Hook kernel data structures
Rootkit discussion - "Average coder" rootkit - Phalanx 2" rootkit - "Suterusu" rootkit
We conduct this seminar online for you. You can book the training as a public seminar or as a company seminar. The practical exercises are carried out in our Remotelab and make up 40-50 percent of the seminar.
Your contacts
-
Promise Akachukwu Kelechi
E-Mail: promise@computer-training.ng
Phone: +234 1 227 9218 -
Peter Chidiebere Ugochukuw
E-Mail: peter@computer-training.ng
Phone: +234 1 227 9218 -
Raphael Chukuwgozie Ndubuisi
E-Mail: raphael@computer-training.ng
Phone: +234 1 227 9218
We offer seminars with a high practical relevance. The contents and exercises are geared to your daily tasks in the company and completely dispense with advertising references to other products of the software manufacturer.
All our training courses are manufacturer-independent. This enables us to offer critical considerations of the products themselves and comparisons with competitors of the manufacturer in the seminar. The course contents are our own and derived from the practical experience of our trainers in projects.
Of course, the contents of company seminars can be individually adapted to your needs. Please do not hesitate to contact us.
- Implementation guarantee - Implementation guarantee for two or more participants
- Mobile classrooms - the ideal complement for company seminars
- Free support - for questions after the seminar
- Delivery on account - no prepayment required
- Interview with the trainer / quality assurance - get to know and assess the trainer in advance
- Clarify seminar requirements - review your knowledge with the trainer
- Assistance with travel costs - we cover part of the costs of hotel accommodation
- Meals - all day cold / hot drinks and a full lunch in the restaurant
- Location of training centres - always centrally located and easily accessible
- Discount - we have attractive prices, take advantage of our additional discounts
- Remotelabs - rent our Remotelabs for your own seminars or as a complement to your company seminars
Réservation
Das Seminar wurde auf die Merkliste gesetzt
Das von Ihnen gewählte Seminar wurde bereits auf die Merkliste gesetzt
Bitte wählen Sie einen freien Termin aus
Bitte geben Sie Ihren Wunschtermin im Format tt.mm.jjjj ein
Bitte wählen Sie einen freien Termin aus
Bitte geben Sie den gewünschten Termin im Format tt.mm.jjjj der Schulung ein