RSA NetWitness^® Platform Training

Getting Started with Archer: Beginning Your Learning Journey - New!

This course is the perfect place to start your Archer training journey. Use this introductory session to determine which training path is right for you or the other individuals in your organization. Looking for training on Solutions & Use Cases? This course will show you where to find the most up-to-date information!

Getting Started with Archer: Introduction to Archer

This 20-minute interactive course provides a high-level, easy to understand overview of the purpose of the Archer Suite, its most common use cases, and how Archer can benefit an organization interested in governance, risk and compliance (GRC).

Getting Started with Archer: Foundational Skills

This 30-minute self-paced course provides an overview of the foundational skills required by any Archer user, regardless of use case. Designed for individuals new to Archer, the video will get users up and running before attending the Developing Archer Power Users and Business Analysts course or the Admin I training. (v6.9)

Getting Started with Archer: Deployment Options - New!

This 30-minute On-demand course explores each deployment scenario available for Archer. The training content also includes criteria for decision-making purposes and shows why or when you may choose one deployment option over the other. (v6.9)

Archer Advanced Workflow Beyond the Basics - New

This one-day workshop expands on Advanced Workflow skills introduced during the Archer Administration II course. Participants will engage in advanced hands-on activities that build upon previously acquired skills. (v6.8)

Archer Advanced Workflow Troubleshooting

This 20-minute self-paced learning provides the knowledge and skills required to troubleshoot the Archer Advanced Workflow feature.

Introduction to Archer APIs

Are you an existing Archer customer interested in API integration? This 30-minute On-Demand learning will cover all the basics to get you started! This course is an introduction to APIs as a general concept and explains how APIs can be used with Archer.

Archer APIs - A Practical Lab

Are you an Archer customer looking to know all about APIs? This On-Demand Lab will get you started on your API journey utilizing the three Archer APIs. Estimated time to complete is 3 hours.

Archer On-Demand Subscription

Start your learning journey to Business-Driven Security with RSA University’s On-Demand Subscription. This offering provides learners a flexible way to access the training they need, when they need it. The subscription allows self-paced training at a significant discount versus Live Classroom training.

Each subscription is value-priced to allow a single student to select the On-Demand courses of interest during the one (1) year subscription period.

Extra week - Virtual Lab extension

Extra one week/10 hours of virtual lab time per person. Follow instructions to request an extension to your existing (active) lab environment. If your lab session has expired or run time has ended, a new environment will be provisioned. Once an environment has expired or run time has ended, all previous work will be lost.

Introduction to the RSA NetWitness Platform

This training includes role and fundamental concepts of the RSA NetWitness Platform. Threat visibility and analysis capabilities available via such tools as email reconstruction, event and file analysis, and meta keys are discussed, as well as basic architecture and data flow. Another section demonstrates the Platform in action when drawing data from infrastructure logs, network packet capture, and endpoint monitoring. 

RSA NetWitness Platform 11.5: What's New

This training provides an overview of the new features and enhancements available in the different RSA NetWitness Platform releases. 

RSA NetWitness Log Parser Tool

 In this course you will learn how to create and deploy a log parser for a specific device by viewing demonstrations using the Log Parser Tool (LPT). 

RSA NetWitness UEBA Overview

This training is an introduction to the RSA NetWitness UEBA solution. Training covers the basics of UEBA and how it works, as well as demonstrations on how to navigate the UEBA user interface. Other topics include the UEBA architecture, how it relates to system workflow, and the setup & administration of UEBA.

RSA NetWitness Orchestrator Fundamentals

These on-demand classes provide foundational concepts of the RSA NetWitness Orchestrator. Students will gain insights into the major features of the product via video demonstrations, explanations, and screenshots.

THREATCONNECT: RSA NetWitness Orchestrator Built on ThreatConnect - Fundamentals

DEMISTO: RSA NetWitness Orchestrator Fundamentals (Demisto 4.5)

RSA NetWitness Platform Foundations

Version 11.5

Version 11.4

This classroom training provides a foundational overview of the core components of RSA NetWitness Platform. Students gain insight into the core concepts, uses, functions and features and also gain practical experience by performing a series of hands-on labs.

RSA NetWitness Endpoint Foundations

Version 11.5

Version 11.4

Version 11.3

This classroom-based training provides a general introduction to RSA NetWitness Endpoint analysis. Students will participate in both lectures and hands-on experience using the RSA NetWitness Endpoint Analytics tool. The course consists of about 50% hands-on lab work, using a virtual lab environment.

RSA NetWitness Platform ESA Fundamentals

This On-Demand learning course presents an overview of Event Stream Analysis including a description of correlation approaches and ESA’s role in correlation, ESA components and features, when to use ESA and how configuration settings affect ESA rules. It focuses on the basics of ESA including architecture, creating basic rules, deploying rules, creating enrichments and notifications and forwarding alerts to the RESPOND module.

RSA NetWitness Administration I  Training

Version 11.5

Version 11.4

Version 11.3

This classroom-based course provides an overview of essential administrative tasks that are performed in order to get the RSA NetWitness Platform up and running. Students gain insight into configuring hosts and services and managing users within RSA NetWitness Platform and gain practical experience by performing a series of hands-on labs.

RSA NetWitness Administration II Training

Version 11.5

Version 11.4

Version 11.3

This classroom training provides students with the knowledge and skills related to the administration and operation of the RSA NetWitness Platform. Topics covered include NetWitness Platform Services, Health and Wellness, Event Source Monitoring, backup and recovery, and administration tools for monitoring and troubleshooting the NetWitness platform. Students will gain practical experience by performing a series of hands-on labs.

RSA NetWitness Reporting

Version 11.4

Version 11.3

This training outlines and demonstrates the use of the RSA NetWitness Platform Reporting Engine to create simple and complex reports and configure execution properties by scheduling reports. Students will learn about and practice configuring the Reporting Engine’s data sources as well as create reports, alerts and charts. 

RSA NetWitness Analysis Training

Version 11.5
Version 11.4

Version 11.3

This training provides hands-on experience using the RSA NetWitness Platform to investigate and remediate security incidents. The course consists of about 50% hands-on lab exercises, following a practical methodology from the incident queue through investigation, event reconstruction, damage assessment, and documentation using real-world use cases. Please choose the training course and version below for detailed information and to register.

RSA NetWitness Introduction to Hunting

Version 11.5

Version 11.4

Version 11.3

This training provides an overview of threat hunting and covers hunting tools, content and methodologies that can be used to proactively find suspicious behavior. Students will apply the techniques acquired in this course to identify anomalies and find threats in the environment using Packets, Logs, and Endpoint. Please choose the training course and version below for detailed information and to register. 

RSA NetWitness Platform Hunting Challenge

This Instructor-led ONLY class gives the students the opportunity to hunt for adversaries in a realistic environment with real-time attacks happening during the class. Students will be provided with several complex, multipart cyberattack use cases to work through, and will be tasked with finding key evidence about the attack, identifying targeted and compromised systems, reconstructing the sequence of events, and proposing a remediation plan. Students also will compete against each other to collect points through their investigation and by answering questions. 

RSA NetWitness Orchestrator Incident Response

This training introduces students to the RSA NetWitness Orchestrator toolbox. It describes the role of RSA NetWitness Orchestrator for bridging NetWitness and third-party SOC tools to use and build incident response playbooks that consist of automated and hands-on actions.

THREATCONNECT: RSA NetWitness Orchestrator Incident Response Built on ThreatConnect 

DEMISTO: RSA NetWitness Orchestrator Incident Response (Demisto 4.5)

RSA NetWitness Content Creation

Version 11.5

Version 11.4

Version 11.3

This training provides recommended methodologies for creating content to assist you in discovering, analyzing and resolving threats in RSA NetWitness Platform. Students will benefit from both lecture and hands-on lab exercises using a virtual environment to practice the techniques learned in class. Please choose the training course and version below for detailed information and to register. 

RSA NetWitness Platform ESA EPL Rules

This on-demand learning identifies a best practice strategy for creating EPL rules as well as for learning the EPL rule syntax. It uses examples and use cases to illustrate EPL rule concepts, such as streams, constructs, data windows and time constraints.

NetWitness On-Demand Subscription

This offering provides learners a flexible way to access the training they need when they need it. The on-demand subscription is value-priced to allow a single student access to all of the training they need for a period of one (1) year. This on-demand subscription allows self-paced enablement at a significant discount versus Live Classroom training.

The NetWitness on-demand subscription includes all the on-demand classrooms, on-demand labs, and on-demand learning for Administrators and Analysts using NetWitness Platform and NetWitness Endpoint.  

NetWitness Administrator Training Package

This offering provides learners a flexible way to access the training they need when they need it. The on-demand package is value-priced to allow a single student access to all of the training they need for a period of one (1) year. This on-demand package allows self-paced enablement at a significant discount versus Live Classroom training.

The NetWitness Administrator Training Package includes all the on-demand classrooms, on-demand labs, and on-demand learning for NetWitness Administrators Only.

NetWitness Analyst Training Package

This offering provides learners a flexible way to access the training they need when they need it. The on-demand package is value-priced to allow a single student access to all of the training they need for a period of one (1) year. This on-demand package allows self-paced enablement at a significant discount versus Live Classroom training.

The NetWitness Analyst Training Package includes all the on-demand classrooms, on-demand labs, and on-demand learning for NetWitness Analysts Only.

RSA Certified Information Systems Security Professional (CISSP) Certification Review

This certification review course involves intensive lectures and question reviews delivered by an experienced security professional practitioner with years of experience. Not only will participants become prepared to pass the exam, but the anecdotes and real-world examples for the course are invaluable insight into real world security challenges and approaches on how to solve them.

EC Council: Certified Incident Handler (CIH) Course & Exam

The EC-Council Certified Incident Handler (ECIH) program is designed to provide the fundamental skills to handle and respond to the computer security incidents in an information system. The course addresses various underlying principles and techniques for detecting and responding to current and emerging computer security threats. Students will learn how to handle various types of incidents, risk assessment methodologies, and various laws and policies related to incident handling. After attending this course, they will be able to create incident handling and response policies as well as deal with various types of computer security incidents.

EC Council: Certified Network Defender (CND) Bootcamp & Exam

Certified Network Defender (CND) is a vendor-neutral, hands-on, instructor-led comprehensive network security certification training program. It is a skills-based, lab intensive program based on a job-task analysis and cybersecurity education framework presented by the National Initiative of Cybersecurity Education (NICE). The course has also been mapped to global job roles and responsibilities and the Department of Defense (DoD) job roles for system/network administrators. The course is designed and developed after extensive market research and surveys.

EC Council: Computer Hacking Forensic Investigator (CHFI) Course & Exam

CHFI v9 covers detailed methodological approach to computer forensic and evidence analysis. It provides the necessary skill set for identification of intruder’s footprints and gathering necessary evidence for its prosecution. All major tools and theories used by cyber forensic industry are covered in the curriculum.

EC Council: Certified Security Analyst Course & Exam

The ECSA pentest program takes the tools and techniques you learned in the Certified Ethical Hacker course (CEH) and enhances your ability into full exploitation by teaching you how to apply the skills learned in the CEH by utilizing EC-Council’s published penetration testing methodology. It focuses on pentesting methodology with an emphasis on hands-on learning. The new ECSAv10 includes updated curricula and an industry recognized comprehensive step-by-step penetration testing methodology.

EC Council: Advanced Penetration Testing Course

The ECCAPT consists of entire network segments that replicate an enterprise network — this is not a computer game simulation, this is an accurate representation of an enterprise network that will present the latest challenges Licensed Penetration Tester (Master) Licensed Penetration Tester (Master) to the pen tester. Since the targets and technology continue to change, the ECCAPT is dynamic and machines and defenses will be added as they are observed in the wild. Finally, the targets and segments are progressive in nature, once you get into one machine and or segment, the next one will challenge you even more.

EC Council: Certified Chief Information Security Officer (CCISO) Course & Exam

EC-Council’s CCISO Program has certified leading information security professionals around the world. Each segment of the program was developed with the aspiring CISO in mind and looks to transfer the knowledge of seasoned professionals to the next generation in the areas that are most critical in the development and maintenance of a successful information security program. The Certified CISO (CCISO) program is the first of its kind training and certification program aimed at producing top-level information security executives.

RSA Identity Governance and Lifecycle Product Overview

This on-demand learning provides an introduction to the challenges of managing identity risks, how to extract the most relevant identity risks in an organization, and address these challenges with the customer. (IGL v7.2)

RSA Identity Governance & Lifecycle Product Fundamentals

This on-demand learning series introduces basic concepts across a variety of functions, capabilities, and operations available in the RSA Identity Governance and Lifecycle product. (IGL v7.2)

RSA Identity Governance & Lifecycle: Access Reviews for Managers

This On-Demand learning course introduces insights on how to perform Access Reviews once assigned to reviewers. (IGL v7.2)

RSA Identity Governance and Lifecycle I - Administration 

This 4-day instructor-led training provides an overview of the concepts, processes, and procedures necessary to successfully use, configure and administer RSA Identity Governance and Lifecycle. It is intended to give new RSA IGL administrators a foundation of knowledge to build applications, collectors, configure reviews, create reports and dashboards, and understand the fundamentals of the Access Request module. (IGL v7.2)

RSA Identity Governance and Lifecycle II - Advanced Configuration and Design

This 4-day classroom-based training leverages RSA Identity Governance and Lifecycle platform functionality to expand the basic administration concepts introduced in the RSA Identity Governance and Lifecycle I – Administration course.It is intended to expand RSA IGL administrators’ knowledge by providing hands-on experience for the advanced topics. (v7.2.1)

RSA Identity Governance & Lifecycle Troubleshooting

Are you an RSA Identity Governance and Lifecycle administrator or user looking for recommended practices and basic troubleshooting? This OnDemand learning will provide you with the right information to get started. (IGL v7.1.2)

RSA Identity Governance & Lifecycle Self-Guided Exploration Lab

This On-Demand lab enables learners to explore RSA Identity Governance & Lifecycle and all underlying features. The lab environment is equipped with existing data and a general roadmap that will provide learners with hands-on experience on all major system features.

Extra week - Virtual Lab extension

Extra one week/10 hours of virtual lab time per person. Follow instructions to request an extension to your existing (active) lab environment. If your lab session has expired or run time has ended, a new environment will be provisioned. Once an environment has expired or run time has ended, all previous work will be lost.

RSA Identity Governance & Lifecycle On-Demand Subscription

Start your learning journey to Business-Driven Security with RSA University’s On-Demand Subscription. This offering provides learners a flexible way to access the training they need, when they need it. The subscription allows self-paced training at a significant discount versus Live Classroom training.
Each subscription is value-priced to allow a single student to select the On-Demand courses of interest during the one (1) year subscription period.

Introduction to the RSA SecurID Access Solution  - Updated!

This on-demand learning presents an overview of the functions and capabilities of the RSA SecurID Access product family.

Introduction to the RSA SecurID Access Architecture - Updated!

This on-demand learning presents an overview of the core architectural concepts and components of the RSA SecurID Access system.

RSA SecurID Access Migration Scenarios

This on-demand course describes the features and functions that are new in RSA Authentication Manager v8.x compared to v6.1 or v7.1. It also provides information on the additional authentication options available when moving an RSA SecurID Access Base edition deployment to an Enterprise or Premium edition.

RSA SecurID Access I - Administration

This training course describes the functions and operations associated with managing endpoint and cloud application protection utilizing multi-factor authentication approaches. Hands-on exercises paired with practical use cases provide a rich educational experience to quickly gain expertise on the RSA SecurID Access system. (AM v8.4)

RSA SecurID Access II - Infrastructure Administration and Tuning

This training course describes how to deploy and install RSA cloud application and endpoint security components.
Hands-on exercises paired with practical use cases provide a rich educational experience to quickly gain expertise in deploying an RSA SecurID Access system. (AM v8.4)

RSA SecurID Access Connectors Deep Dive

This On-Demand learning presentation explains how to configure RSA SecurID Access SAML and HFED (HTTP Federation Proxy) connectors that in turn are the configuration for SAML or HFED Applications, respectively. From podcasts presented by RSA Partner Engineering, the details of the connector parameters are discussed as well as how they are used in configuring RSA SecurID Access applications.

Troubleshooting RSA SecurID Access

This On-Demand learning presentation provides an introduction to troubleshooting RSA SecurID Access from an experienced Professional Services perspective. Experience from an RSA subject matter expert and demonstrations make this presentation highly interactive and informative.

RSA SecurID Access Self-Guided Exploration Lab - New!

This On-Demand lab enables students to explore all available features of the RSA SecurID Access platform with minimal step-by-step instructions. Learners are presented with general suggestions and cases where they can start to populate users, create policies, and construct other scenarios that they may not want to attempt in their production systems or explore features and functions not currently licensed to them. Experience in this lab environment can also help prepare for RSA certification.

Embedding a SecurID Access Identity Router - New!

This On-Demand Lab training describes and provides hands-on practice in embedding an RSA SecurID Identity Router into an existing RSA Authentication Manager server.

RSA Authentication Manager Help Desk Proficiency

This On-Demand Lab course provides the learner with hands-on experience to understand RSA Authentication Manager and RSA SecurID authenticators and authentication methods, as well as how functions and controls are accessed in the administrative interface. Demonstrations of important operations relating to typical end user cases reinforce the steps that Help Desk representatives can take for troubleshooting and assisting their user population.

RSA SecurID Access Prime Suite Implementation Workshop

RSA Authentication Manager Integration Services (AMIS) API functions along with RSA SecurID Access Prime kit offer a robust set of tools to augment an RSA SecurID Access implementation. Administrative, Help Desk and end-user Self-Service capabilities can be built through a REST interface to help customize access to common administrative operations and end-user services. This Professional Services-led workshop explains the RSA Authentication Manager Integration Services API and RSA SecurID Access Prime Suite functionality as implemented within your own organization.

Extra week - Virtual Lab extension

Extra one week/10 hours of virtual lab time per person. Follow instructions to request an extension to your existing (active) lab environment. If your lab session has expired or run time has ended, a new environment will be provisioned. Once an environment has expired or run time has ended, all previous work will be lost.

RSA SecurID Access On-Demand Subscription

Start your learning journey to Business-Driven Security with RSA University’s On-Demand Subscription. This offering provides learners a flexible way to access the training they need, when they need it. The subscription allows self-paced training at a significant discount versus Live Classroom training.
Each subscription is value-priced to allow a single student to select the On-Demand courses of interest during the one (1) year subscription period.

RSA Authentication Manager 8.4 P4 New Product Readiness

This course describes the new features and capabilities included in the RSA Authentication Manager 8.4 P4 product release.

What’s New in RSA Authentication Manager v8 Releases

This on-demand learning describes the RSA Authentication Manager features, functions, and new capabilities that have been added in the v8.2 and later product releases. An overview of each functional area is presented along with information on upgrading from previous versions