Course description
As a learner, you will begin by exploring event search and reporting features using Recon’s default content to get familiar with the interface and its core functionalities. As the course progresses, you will engage in hands-on exercises to build more advanced event searches, reports, and dashboards from the ground up.
You will also analyze security events tied to specific use cases, such as detecting threats from former employees, investigating the Log4j vulnerability, and uncovering insider threats related to data exfiltration. By applying your knowledge of Recon, you will examine these scenarios to identify targets, indicators of compromise (IoCs), and potential attackers.
This course is ideal for security analysts who want to enhance their threat detection and investigation capabilities by leveraging ArcSight Recon’s event search, reporting, and dashboarding features to identify anomalies, uncover threats, and support proactive security operations.
