AI Engine Fundamentals Training v7.3.pptx - AI Engine Fundamentals Good Morning Welcome to LogRhythm AI Engine Fundamentals Training The course will

AI Engine Fundamentals Training v7.3.pptx - AI Engine...

This preview shows page 1 - 10 out of 64 pages.

AI Engine Fundamentals
Image of page 1

Subscribe to view the full document.

AI Engine Fundamentals 2 Welcome to LogRhythm AI Engine Fundamentals Training! The course will begin at 8:30 AM Mountain Time. Please use this time to check your connection to our Virtual Training Environment by going to . To reduce background noise, please mute your telephone/microphone. Please download today’s training material if you have not done so already. A PDF copy of the AI Engine Fundamentals can be downloaded from LogRhythm University, under the course for today. Please let me know if there are any issues downloading the file. If you have any other questions, please send them my way in the chat window. Good Morning!
Image of page 2
AI Engine Fundamentals 3 The objective of this training course is to enable you to create and edit AI Engine Rules. You can expect to leave class with an understanding of how AI Engine functions, an understanding the configuration of AI Engine Rules, and common threats and attack scenarios for which the rules are configured to monitor. Introduction to the Advanced Intelligence Engine (AI Engine) AI Engine Rules Threshold and Unique Values Rule Blocks Behavioral Rule Blocks: Whitelist Behavioral Rule Blocks: Statistical and Trend Challenges AI Engine Fundamentals Training Agenda
Image of page 3

Subscribe to view the full document.

CHAPTER 1 The objective of this chapter is to introduce you to the AI Engine and its role in the LogRhythm Platform. AI Engine Overview Compound Rules Log Data Flow Actions Specified in AI Engine Rules AI Engine Rules in the Knowledge Base AI Engine Fundamentals 4 Introduction
Image of page 4
An advanced analytics component that evaluates and correlates real-time log data. Sophisticated intrusions Insider threats Behavioral anomalies Compliance violations Disruptions to IT services And many other critical events AI Engine Overview AI Engine Fundamentals 5
Image of page 5

Subscribe to view the full document.

Rule Blocks enable AI Engine to evaluate and correlate multiple logs. The Rule Blocks are combined to make compound rules capable of detecting sophisticated attacks and complex operational issues. Compound Rules AI Engine Fundamentals 6
Image of page 6
AI Engine Fundamentals 7 Log Data Flow Platform Manager AI Engine Data Processor Data Indexer Cluster HOST LOGS System Security Audit Application Database NETWORK & SECURITY LOGS Network Devices IDS / IPS DLP Flow System Monitor ENDPOINT MONITORING FIM / RIM Processes Network Connections Data Loss Defender Processed Logs Events AIE Events Raw Logs and Metadata Raw Logs Alarms Notifications SmartResponses
Image of page 7

Subscribe to view the full document.

AI Engine Fundamentals 8 When criteria for an AI Engine Rule is matched, LogRhythm can take the following actions: AIE Events made visible in the Consoles AIE Alarms made visible in the Consoles Notifications sent to users or groups via: SMTP emails in HTML format SNMP Traps Text files SmartResponse remediation Actions Specified in AI Engine Rules AI Engine PM
Image of page 8
AI Engine Fundamentals 9 Ensure the desired KB Modules have been loaded and enabled.
Image of page 9

Subscribe to view the full document.

Image of page 10
  • Winter '19
  • madan
  • Statistics, The Rules, Logarithm

What students are saying

  • Left Quote Icon

    As a current student on this bumpy collegiate pathway, I stumbled upon Course Hero, where I can find study resources for nearly all my courses, get online help from tutors 24/7, and even share my old projects, papers, and lecture notes with other students.

    Student Picture

    Kiran Temple University Fox School of Business ‘17, Course Hero Intern

  • Left Quote Icon

    I cannot even describe how much Course Hero helped me this summer. It’s truly become something I can always rely on and help me. In the end, I was not only able to survive summer classes, but I was able to thrive thanks to Course Hero.

    Student Picture

    Dana University of Pennsylvania ‘17, Course Hero Intern

  • Left Quote Icon

    The ability to access any university’s resources through Course Hero proved invaluable in my case. I was behind on Tulane coursework and actually used UCLA’s materials to help me move forward and get everything together on time.

    Student Picture

    Jill Tulane University ‘16, Course Hero Intern

Ask Expert Tutors You can ask 0 bonus questions You can ask 0 questions (0 expire soon) You can ask 0 questions (will expire )
Answers in as fast as 15 minutes