Describe correlation searches, adaptive response actions, and notable events
Configure ES roles and permissions
Module 2 – Security Monitoring
Customize the Security Posture and Incident Review dashboards
Create ad hoc notable events
Create notable event suppressions
Module 3 – Risk-Based Alerting
Give an overview of Risk-Based Alerting (RBA)
Explain risk scores and how they can be changed
Review the Risk Analysis dashboard
Describe annotations
View Risk Notables and risk information
Module 4 – Incident Investigation
Review the Investigations dashboard
Customize the Investigation Workbench
Manage investigations
Module 5 – Installation
Give an overview of general ES install requirements
Explain the different add-ons and where they are installed
Provide ES pre-installation requirements
Identify steps for downloading and installing ES
Module 6 – General Configuration
Set general configuration options
Configure local and cloud domain information
Work with the Incident Review KV Store
Customize navigation
Configure Key Indicator searches
Module 7 – Validating ES Data
Verify data is correctly configured for use in ES
Validate normalization configurations
Install additional add-ons
Module 8 – Custom Add-ons
Ingest custom data in ES
Create an add-on for a custom sourcetype
Describe add-on troubleshooting
Module 9 – Tuning Correlation Searches
Describe correlation search operation
Customize correlation searches
Describe numeric vs. conceptual thresholds
Module 10 – Creating Correlation Searches
Create a custom correlation search
Manage adaptive responses
Export/import content
Module 11 – Asset & Identity Management
Review the Asset and Identity Management interface
Describe Asset and Identity KV Store collections
Configure and add asset and identity lookups to the interface
Configure settings and fields for asset and identity lookups
Explain the asset and identity merge process
Describe the process for retrieving LDAP data for an asset or identity lookup
Module 12 – Managing Threat Intelligence
Understand and configure threat intelligence
Use the Threat Intelligence Management interface
Configure new threat lists
Module 13 – Supplemental Apps
Review apps to enhance the capabilities of ES including, Mission Control, SOAR, UBA, Cloud-based Streaming Analytics, PCI Compliance, Fraud Analytics, and Lookup File Editor
