
An introduction to this independent training by Yaz Bekkar, including the SIEM topics and lab exercises covered in the lessons. The course teaches users of SolarWinds® Security Event Manager (SEM) software. It is not affiliated with, sponsored by, endorsed by, authorized by, or produced by SolarWinds Worldwide, LLC, and does not award vendor certification.
Syslog is the system logging protocol that forwards events to a central server for centralized monitoring; SolarWinds SIEM processes and correlates these logs in real time to alert on breaches.
Learn to use all features of SolarWinds Security Event Manager to monitor network devices, servers, users, and workstations, and deploy with active responses to block malicious attacks.
Learn how SolarWinds Security Event Manager collects and centralizes host, application, and security device logs, categorizes events, and generates prioritized alerts to detect incidents and support compliance.
Explore SolarWinds security event manager deployments. A virtual appliance extracts events from servers and workstations via TCP with agents, executes active responses, and forwards logs using TCP or UDP.
Explore useful information about SolarWinds SEM, a SIEM for network security, and learn how to apply it to enhance security operations.
Explore Gns3, the graphical network simulator that emulates real device software like Cisco IOS, Juniper Junos, and FortiGate, enabling cost-efficient, risk-free testing without disrupting production networks.
Deploy a hands-on lab for SolarWinds Security Event Manager (siem) using VirtualBox or VMware, Gns3, and the SAM appliance to simulate FortiGate, Mikrotik, and Cisco networks.
Learn to configure gns3 with nested virtualization, enable BIOS virtualization, set at least 2 GB RAM, and import and attach VirtualBox VMs for reliable connectivity.
Learn step-by-step lab troubleshooting for unreachable devices in Gns3: verify firewall, subnet, VLAN membership, correct IP addresses, and proper server and device startup order.
Integrate Sophos XG into your lab by importing primary and auxiliary appliances in Gns3, update to version 18.0.5, and enable SNMp or syslog for monitoring.
Set up and activate the Sophos XG firewall for a 30-day trial. Configure the network, register a Sophos ID, and complete the initial console steps to access the web interface.
Install SolarWinds Security Event Manager on Hyper-V and VMware, and explore deployment on a workstation. Discuss challenges such as VRF file transfers and nested Hyper-V in VMware Workstation.
Deploy the SolarWinds Security Event Manager (SIEM) on VMware to enable security event collection and enhance network security across the environment.
Deploy SolarWinds SIEM to a Hyper-V environment to enhance network security monitoring and event management.
Enable Hyper-V nested in VMware Workstation to create a scalable virtualization lab. Use this setup to practice network security monitoring with SolarWinds SIEM.
Deploy a virtual appliance to Azure within the SolarWinds Security Event Manager (SIEM) framework to strengthen network security and threat monitoring.
Master how to remotely connect to a SEM server on Azure using SSH for secure access and effective management of SolarWinds SIEM network security.
Perform the initial configuration of the SolarWinds security event manager (siem) to support network security.
Enable ssh in SolarWinds Security Event Manager (SEM) to enhance network security within the SIEM.
Explore how SEM handles unrestricted SSH access for one or more IP addresses or hostnames, and how it enhances monitoring and security event management.
Configure backups in SEM for the SolarWinds Security Event Manager within SIEM network security. Explore backup config in SEM for SolarWinds and SIEM network security.
Configure SNMP to monitor your virtual appliance using SolarWinds SEM for enhanced network security and SIEM visibility.
Explore how restricted and unrestricted reports access works within SolarWinds Security Event Manager, and learn best practices for managing report permissions in SIEM-driven network security.
Explore restricted and unrestricted access to the web console of the SolarWinds Security Event Manager (SIEM). Understand how access controls affect network security and monitoring.
Install and configure the Windows agent for SolarWinds SEM locally to enhance SIEM-based network security monitoring.
Install the SEM remote agent installer for large Windows deployments. Learn how this enables SolarWinds SIEM for improved network security.
Discover how to install the SEM local agent non-interactively to streamline SolarWinds SIEM deployment and strengthen network security monitoring.
Explore practical dashboard tricks and options in SolarWinds Security Event Manager to enhance SIEM monitoring and network security.
compare sem connectors and agents in solarwinds security event manager to clarify how each integrates with network security monitoring.
Configure Cisco to forward syslog messages to the SolarWinds Security Event Manager (SEM) via the connector, enabling centralized security monitoring.
This is independent training by Yaz Bekkar for users of SolarWinds® Security Event Manager (SEM) software. It is not affiliated with, sponsored by, endorsed by, authorized by, or produced by SolarWinds Worldwide, LLC. This course does not award vendor certification.
Learn security information and event management (SIEM) concepts through explanations, demonstrations and practical lab exercises. The lessons focus on using SEM to collect logs, examine events, configure rules and explore response workflows. Product names identify the software demonstrated in the lessons.
Begin with syslog concepts, software requirements and deployment scenarios. Follow the lab setup examples and explore virtual appliance deployment using VMware, Hyper-V and Microsoft Azure. The configuration lessons introduce remote access, backups, monitoring and console access settings.
Practice installing agents and configuring connectors for devices that forward their logs. Explore dashboards, event views and filtering to understand the information collected from servers, workstations and network devices. Follow examples that relate individual events to activity requiring investigation.
The course also examines rules, notifications and active responses. Learn how event correlation can support investigations and how response settings behave in a lab. Additional topics include file integrity monitoring, user activity, USB monitoring and report generation. These lessons present software capabilities for study and practice rather than promises of security or regulatory compliance.
This course is intended for IT engineers, system administrators and security practitioners with basic IT knowledge. Use the exercises to build familiarity with the interfaces and workflows shown in the recorded lessons, then evaluate how those techniques relate to your own environment.
SolarWinds and the referenced SolarWinds product names are trademarks of SolarWinds Worldwide, LLC or its affiliates. They are used solely to identify the software covered by this independent course.