RepSM Demo Script 1

Summary:

The "Reputation Security Monitor (RepSM) Demo Script" is a step-by-step guide designed to showcase the features and benefits of HP ArcSight's RepSM solution version 1.0. Key steps include logging into the HP ArcSight Console as an admin, clearing previous related cases, importing demo data, setting up channels, accessing relevant dashboards, exploring lists for detailed analysis, and utilizing visual aids in a PowerPoint presentation during the demonstration. This script aims to provide an engaging experience that highlights RepSM's capabilities in addressing security threats by analyzing malicious domains and IPs through real-time event processing and visualization tools within the ArcSight platform.

Details:

The "Reputation Security Monitor (RepSM) Demo Script" is a guide designed to assist users in effectively demonstrating the capabilities of the HP ArcSight Reputation Security Monitor, version 1.0. This script outlines essential steps and actions that need to be taken when performing a demonstration using this solution. Here's an overview of each step: 1. **Setup**: Begin by logging into the HP ArcSight Console as an administrator. Ensure you have access to both the HP ArcSight console and its sub-systems, including solutions like Reputation Security Monitor (RepSM). 2. **Preparation**: Clear any existing cases related to "Internal Infected Assets" under the specified solution path in the ArcSight setup. This step ensures a clean demonstration environment without historical clutter. 3. **Data Import**: Start the replay connector and upload the provided RepSM_demo.events file, configuring it for an event processing rate of 50 EPM (Events Per Minute). Note that certain parts of this demo may require querying trend tables which can take time to populate; consider sending the demo events multiple times during your demonstration day or schedule accordingly based on expected data availability. 4. **Channel Setup**: Open the Active Channel located at /ArcNet Active Channels/Demo Live to ensure real-time event processing and visualization within the ArcSight platform. 5. **Dashboard Access**: Display key dashboards related to RepSM:

• Navigate to the solution path /ArcSight Solutions/Reputation Security Monitor for an overview of the overall status.

• Open the dashboard at /Overview/RepSM Overview for a concise snapshot of current conditions.

• View the dashboard at /Reputation Data Analysis/Reputation IP Database Overview to analyze data related to malicious domains and IPs.

6. **List Exploration**: Access the lists feature within ArcSight and go to the path /Arcsight Solutions/Reputation Security Monitor. Right-click on the Malicious Domains and Malicious IP Addresses entries in this list to view detailed information about each entry, which can provide valuable insights during the demonstration. 7. **Visual Aids**: Refer to a PowerPoint presentation titled "HP ArcSight Express and ESM – Demo Script.pptx" for visual aids such as screenshots that illustrate how to navigate through these steps in the HP ArcSight console. These visuals will help keep your audience engaged, providing context alongside your verbal explanations. This script is designed not only to guide you through a successful demonstration but also to provide attendees with an interactive and informative experience, showcasing the capabilities of the HP ArcSight Reputation Security Monitor for addressing security threats effectively.

Disclaimer:

The content in this post is for informational and educational purposes only. It may reference technologies, configurations, or products that are outdated or no longer supported. If there are any comments or feedback, kindly leave a message and will be responded.