Define ESM User Roles

List ArcSight Components, Interfaces, Information Resources

Describe ESM Event Schema and Schema Groups

Identify ArcSight Event Life Cycle Phases and Schema population

Describe Pre-Install Requirements

Identify Install Process (Wizards)

Describe reconfiguration

Describe Login, user preference, and main tool bar facilities

Navigate resource tree, viewer and edit/inspect panels

Login, navigate main tab means

Access dashboards, event search, report, and workflow cases

Navigate administrative facilities for ESM system configuration, connectors status, and event storage and archive

Login to the home page

Access dashboards, reports, active channel and notifications

Access active channels and modify filters and field sets

Use right-click means and event investigation facilities

Differentiate simple vs join type rules, real-time vs scheduled rules

Edit rule attributes, including conditions, aggregation, actions and triggers

Explain the use of active lists and session lists

Access dashboards the interpret data monitor display

Describe the benefits of using identity view

Explain drill down to active channels

Describe query viewer usage

Edit query viewers, establish baselines and define drilldowns

Enter report runtime parameters, run and archive reports

Edit focused reports and delta reports

Established and manage report scheduling distribution

Create ESM Users and User Groups

Explain the administration of ACLs

Password Policies

Describe notification functions and responses

Access, modify and configure notifications

Search events using the search builder/advanced search tools

Display search results and select output options