ArcSight
(อาร์คไซต์)
Definition
ArcSight (อาร์คไซต์) Tool
ArcSight is a security information and event management (SIEM) tool used to monitor, detect, and analyze security threats and incidents within an IT environment.
Expertise Level
Level 1
Basic
1. Understands basic concepts of SIEM and ArcSight interface.
2. Can navigate ArcSight console and run predefined reports.
3. Familiar with basic log collection and event monitoring.
Level 2
Intermediate
1. Can configure correlation rules and alerts in ArcSight.
2. Able to analyze security events and perform incident triage.
3. Understands data normalization and integration with other security tools.
Level 3
Advanced
1. Designs and implements advanced ArcSight use cases and custom parsers.
2. Optimizes SIEM performance and manages large-scale deployments.
3. Leads incident response leveraging ArcSight analytics and reports.
