IBM Security SOAR Videos: How do I...

IBM Security SOAR Videos: How do I... Courses:

An Introduction to the Resilient Incident Response Platform

Overview

The Resilient Incident Response Platform makes incident response efficient and compliant utilizing a knowledge base of incident response best practices, industry standard frameworks, and regulatory requirements.


Duration: 2 minutes

Closed captions: English, French, German, Spanish and Japanese


De En Es Fr Ja
2m      Foundational
Changing Ciphers and Protocols in IBM Resilient

Overview

This course demonstrates how to change the ciphers and protocol in IBM Resilient. There is a review of which ciphers and protocols are used by default using the nmap application, followed by a demonstration of which files need to be edited in order to adjust the ciphers and protocols being used.

Using the nmap application, you can detect default settings for the protocol and ciphers. All versions of TLS are supported (TLS1.0 TLS 1.1 and TLS 1.2).

The predominant ciphers based on RSA and ASE cryptography are supported, as well as the cryptographic ciphers that support forward secrecy based on Diffie Hellman (DF) and Ecliptic Curve Diffie Hellman (ECDH) algorithms.


Closed captions: English, French, German, Spanish and Japanese

5m      Intermediate
Configuring Audit Logging in Resilient

Overview

You can configure the Resilient platform to send audit log messages to the Resilient client.log file and to Syslog, if you have set up and configured Syslog. This video will show you how easy it is to set up.

Closed captions: English, French, German, Spanish and Japanese

De En Es Fr Ja
2m      Foundational
Configuring SMTP Notifications for IBM Resilient

Overview:

This course demonstrates how to configure SMTP notifications for IBM Resilient. Resilient sends email notifications to users for various purposes and Resilient must use an SMTP server to send these messages.


Closed captions: English, French, German, Spanish and Japanese

De En Es Fr Ja
5m      Foundational
Configuring Syslog for Resilient

Overview

This video demonstrates how to configure syslog to run on an IBM Resilient server.


Closed captions: English, French, German, Spanish and Japanese

De En Es Fr Ja
2m      Foundational
Creating custom graphs in the Resilient application

Overview

This video shows examples of creating graphs of incidents over time on the Resilient Analytics dashboard, including

  • Graph incidents by severity
  • Graph time to close by severity
  • Average time to close by severity over time
  • Average time to close by type

The video closes by demonstrating some other examples of graphs:

  • The number of incidents created per month for each user
  • The number of incidents created per month per city
  • Top trend incident category in last 90 days
  • Open incident by severity in last 30 days
  • Top incident category in last 30 days
  • Incident by type in last 90 days
Closed captions: English, French, German, Spanish and Japanese

De En Es Fr Ja
6m      Intermediate
Importing the Resilient License Key

Overview

This course shows you how to import the Resilient license, a necessary step before the Resilient platform can be used. There are two ways to accomplish this task, both of which are shown in the video.

Agenda:

    • Transferring the Resilient license file
    • Importing the Resilient license file
    • Verifying the license import was successful
    • A second method of importing the license
    • Verifying the status of the Resilient license

    This course has been bookmarked to aide navigation and contains English language closed captions.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    5m      Foundational
    Log Configuration in Resilient

    Overview

    The Resilient platform logs various client and server activity in log files, located in the following directory: /usr/share/co3/logs/ This video will show you how to configure logging on the Resilient platform.


    Duration: 4 minutes

    Closed captions: English, French, German, Spanish and Japanese


    De En Es Fr Ja
    4m      Foundational
    Resilient - Artifact Relation

    Overview

    In this video you will learn about the IBM Resilient feature, Artifact Relation. This video is intended for people interested in learning about the Resilient product.


    3m      Foundational
    Resilient - Backing up and Restoring

    Overview

    This course covers backup up and restoring the Resilient application for on-premise customers running Resilient version 27.2 or higher. These procedures will backup and restore all user data in the appliance including the Resilient database, file attachments and the keyvault file.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    3m      Foundational
    Resilient - Backing up the Keyvault

    Overview

    The keyvault stores all passwords used within IBM Resilient. If the keyvault were lost, it would result in a considerable loss of data. For that reason, the Resilient platform runs a backup of keyvault files to the system database anytime passwords are added or removed and after each system upgrade. This course shows how to use the resutil keyvaultrestore command to restore keyvault files from the system database.

    Duration: 4 minutes

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    4m      Foundational
    Resilient - Configuring SSL/TLS Certificates

    Overview

    Configuring Secure Sockets Layer (SSL) or Transport Layer Security (TLS) Certificates in the IBM Resilient Appliance is not difficult. The Resilient Appliance ships with a self-signed certificate but, for optimal security, it is recommended you obtain a certificate from a trusted authority. This course details the steps necessary to obtain and install an SSL or TLS certificate.

    Duration: 4 minutes

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    4m      Foundational
    Resilient - Create Workspace

    Overview

    This course demonstrates how to create a new workspace in IBM Resilient.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    2m      Foundational
    Resilient - Creating a New User using Terminal Commands

    Overview

    This course demonstrates how to create new users using resutil terminal commands


    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    2m      Foundational
    Resilient - Creating a New User using the UI

    Overview

    This course covers the creation of new users using the Resilient user interface as well as the assignment of roles and groups.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    2m      Foundational
    Resilient - Creating Custom Artifact Types

    This video demonstrates how to create Resilient Custom Artifact Types. Custom Artifact Types allow you to better manage the incident response process.

    Duration: 3 minutes

    3m      Foundational
    Resilient - Creating custom graphs for incident time tracking data

    This video shows how you can create custom graphs to report on incident time tracking data from the IBM Resilient Analytics Dashboard.

    4m      Foundational
    Resilient - Creating Roles

    Overview

    This course shows you how to create global or workspace roles in IBM Resilient.

    Global roles define a set of permissions that apply across the organization.
    Workspace roles define a set of permissions for specific workspaces only.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    2m      Foundational
    Resilient - Data Tables

    This video provides an introduction to Resilient Data Tables and their use. Data Tables allows organizing information in a tabular format, using rows and columns enabling administrators to better automate and more closely track the progress of tasks within each step of their incident response plan.

    Duration: 4 minutes

    4m      Foundational
    Resilient - Deactivate user / Reassign

    Overview

    In this video you will learn about the IBM Resilient features including Deactivating users and Reassigning Incidents and Tasks. This video is intended for people interested in learning about the Resilient product.


    3m      Foundational
    Resilient - Defanging URLs

    Overview

    This course demonstrates how to "defang" your URLs in IBM Resilient to help assure users do not inadvertently click on malicious links.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    4m      Foundational
    Resilient - Delete Incident / Bulk Actions

    Overview

    In this video you will learn about the IBM Resilient features including Deleting Incidents and Bulk Actions. This video is intended for people interested in learning about the Resilient product.


    3m      Foundational
    Resilient - Delete Workspace

    Overview

    This course demonstrates how to delete and existing workspace in IBM Resilient.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    2m      Foundational
    Resilient - Deleting or Deactivating a User

    Overview

    This course demonstrates how to delete or deactivate a user from Resilient.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    2m      Foundational
    Resilient - Deleting Roles

    Overview

    This course demonstrates how to delete a role from within IBM Resilient.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    1m      Foundational
    Resilient - Dynamic Playbooks / Rules

    Overview

    In this video you will learn about the IBM Resilient features including Dynamic Playbooks and Rules. This video is intended for people interested in learning about the Resilient product.


    6m      Foundational
    Resilient - Enabling LDAP authentication

    Overview

    This course demonstrates how to set up LDAP authentication for IBM Resilient including a discussion of prerequisite work that must be completed first.


    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    5m      Intermediate
    Resilient - Enabling LDAP users in groups and deleting LDAP users

    Overview

    When creating a Resilient group, you can link the group to any LDAP group. The result is that members of that LDAP group who are also members in the authorized group are added to the Resilient group. Any membership changes in the LDAP group are reflected automatically in the Resilient group. This feature allows you the flexibility to create numerous groups for specific tasks or duties.

    Duration: 9 minutes

    Closed captions: English, French, German, Spanish and Japanese


    De En Es Fr Ja
    9m      Intermediate
    Resilient - Encrypting the Keyvault Password

    Overview

    This course describes how to encrypt a keyvault password in IBM Resilient. The keyvault password is stored as an unencrypted file by default but can be encrypted using gpg to protect it and decrypted whenever needed.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    5m      Intermediate
    Resilient - External Network Configuration

    Overview

    This course describes the external network access needed by Resilient to function properly.

    Duration: 2 minutes

    Closed captions: English, French, German, Spanish and Japanese


    De En Es Fr Ja
    2m      Foundational
    Resilient - Global and Workspace Roles

    Overview

    This short course describes the difference between Global and Workspace roles.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    1m      Foundational
    Resilient - How To Create a Notify Data Protection Officer (DPO) Task in Resilient

    This video demonstrates how to create and use a Notify Data Protection Officer Task to automatically notify your DPO when specified conditions are met.

    Duration: 3 minutes

    3m      Foundational
    Resilient - How To Create Wikis

    Overview

    Users with the required permission can create and edit wiki pages from within the application. This enables organizations to add important information, guidelines, and reference material for the Incident Response team and wikis can be used as part of incident response process. The wiki feature is useful as a central repository for storing content, references, and guidelines to support users working on incidents and tasks. Users can link to existing wiki pages from incident and task notes and other wiki pages.

    Closed captions: English, French, German, Spanish and Japanese


    De En Es Fr Ja
    2m      Intermediate
    Resilient - How to Pre-Select Privacy Regulators

    This videos demonstrates how to use Resilient's customization settings to automatically select specific regulators in your instance of Resilient to save time and automate the incident logging process.

    Duration: 3 minutes

    3m      Foundational
    Resilient - Installing Optional Packages

    Overview

    This course demonstrates how to use the optional packages install for OVA deployments of Resilient.

    Duration: 3 minutes

    Closed captions: English, French, German, Spanish and Japanese


    3m      Foundational
    Resilient - Installing via an OVA File

    Overview

    This course demonstrates how to install the Resilient appliance using an OVA file.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    5m      Intermediate
    Resilient - Keyvaults, Keystores and Secrets

    Overview

    This course discusses keyvaults, keystores and secrets within IBM Resilient.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    5m      Foundational
    Resilient - LDAP Authentication

    Overview

    This course covers LDAP Authentication and the use of LDAP Trees within IBM Resilient.


    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    7m      Foundational
    Resilient - Migrating Organizational Settings

    Overview

    This course demonstrates how to migrate organizational settings by importing and exporting them from one organization to another.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    6m      Foundational
    Resilient - Modify the New Incident Wizard Layout

    This video demonstrates how to modify the Resilient Incident Creation Wizard. The ability to customize the wizard allows administrators to customize the creation of new incidents in Resilient.

    Duration: 6 minutes

    6m      Foundational
    Resilient - Notifications and substitution

    Overview

    Use the notifications feature to alert users when a specific condition occurs for an object. A condition can be anything you choose, such as object creation or deletion, or a change in value to a field. An object can be an incident, note, milestone, task, attachment, or artifact.

    Through substitution you can insert into the body of the notification, information about the object and its parent to provide additional information. The available objects are incident, note, milestone, task, attachment, and artifact. You can reference the parent (incident or task) of the object, and any custom fields of that parent object.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    4m      Intermediate
    Resilient - Organization Details

    Overview

    This course describes how to view and request changes to your organization details within Resilient.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    1m      Foundational
    Resilient - Organization Settings

    Overview

    >This course reviews the organizational settings that can be made on your Resilience instance, such as

    • Session Timeout
    • Attachments
    • Default Tasks
    • Incident Deletion
    • LDAP Authentication
    • Two-Factor Authentication
    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    4m      Foundational
    Resilient - Predefined Roles

    Overview

    A role is a specific set of permissions, which you can assign to users and groups. The Roles tab allows you to define and manage roles. You can assign multiple roles to a user, which gives the user a super-set of all the permissions in the roles.

    This course reviews the predefined roles on the IBM Resilient appliance and provides caution regarding changing critical administrative roles.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    2m      Foundational
    Resilient - Reassigning Incidents and Tasks

    Overview

    This course demonstrates how to reassign incidents and tasks to new owners in Resilient.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    1m      Foundational
    Resilient - Reporting Custom Sections / Flags

    Overview

    In this video you will learn about the IBM Resilient features including Custom Sections and Flags. This video is intended for people interested in learning about the Resilient product.


    2m      Foundational
    Resilient - Role Categories

    Overview

    This course provides an overview of available permissions categories when specifying roles for your IBM Resilient users.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    3m      Foundational
    Resilient - Search

    This video demonstrates the newly expanded Search function in Resilient. The new search functionality provides filtering ability by object type further filter on any available field. It also illustrates the use of wild cards, fuzzy search, and exact phrases search.

    Duration: 4 minutes

    4m      Foundational
    Resilient - Setting the Time Zone

    Overview

    This course demonstrates how to set the time zone on the IBM Resilient Appliance.

    Duration: 3 minutes

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    3m      Foundational
    Resilient - Setting up Res-keyring

    Overview

    This course demonstrates how to setup Res-keyring, a utility to add all of the keyring-based values from your app.config file to your system's compatible keyring backend, such as KeyStore system.

    Duration: 5 minutes

    5m      Foundational
    Resilient - Threat Sources Overview

    Overview

    When artifacts are added to incidents, the Resilient platform can optionally search for those artifacts in several cyber threat sources that have been integrated into the product. This course demonstrates how to enable and disable threat sources in Resilient.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    2m      Intermediate
    Resilient - Tracking time spent on incident field values

    This video shows how you can use the Resilient platform to track time spent on important incident field values.

    4m      Foundational
    Resilient - Two-Factor Authentication

    Overview

    This course covers Two-Factor Authentication with IBM Resilient.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    5m      Foundational
    Resilient - Upgrading the Resilient Appliance Software

    Overview

    This video demonstrates how to upgrade the Resilient Appliance. The Appliance can only be upgraded one major version at a time. This course shows how to install upgrades after they have been downloaded from the IBM Resilient Customer Success Portal.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    3m      Foundational
    Resilient - Workflows

    This video demonstrates how to create workflows in Resilient. Workflows are a graphically designed set of activities that allow you to create a complex set of instructions. The video covers the use of task series, parallel gateway, exclusive gateway, and inclusive gateway.

    Agenda

    • Overview
    • Task series workflow
    • Parallel gateway
    • Exclusive gateway
    • Inclusive gateway


    Duration: 10 minutes

    10m      Foundational
    Resilient - Workspace Key Concepts

    Overview

    This course reviews the key concepts of Resilient workspaces. A workspace is present on the system at all times. Users with the global permission for workspaces can create and manage workspaces. New incidences can be assigned to any of the existing workspaces.

    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    3m      Foundational
    Resilient Prerequisites

    Overview

    This short video discusses the prerequisites necessary to successfully install the Resilient appliance on a host. The Resilient appliance is a self-contained server that runs the Resilient platform.

    Closed captions: English, French, German, Spanish and Japanese


    De En Es Fr Ja
    2m      Foundational
    Running Resilient disaster recovery playbooks

    Overview

    This video shows how to use the Resilient Disaster Recovery system.

    • Enabling the Resilient DR system
    • Verify the DR is enabled correctly using the health monitoring
    • Enabling the receiver as the active Resilient appliance
    • Run a controlled swap of the master and receiver
    • Running a playbook to disable DR
    Closed captions: English, French, German, Spanish and Japanese


    De En Es Fr Ja
    5m      Intermediate
    Setting up Resilient disaster recovery

    Overview

    This video demonstrates how to install and set up the Resilient Disaster Recovery system. The disaster recovery (DR) system involves installing and setting up DR on two appliance systems.

    Setup overview
    - Verify the prerequisites
    - Install and set up DR and optional packages on both appliances
    - Install the SSL certificates
    - Create Ansible vault files for each appliance
    - Create Ansible inventory files for each appliance


    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    9m      Intermediate
    Setting up SAML Authentication in IBM Resilient

    Overview

    This course demonstrates how to set up SAML Authentication in IBM Resilient. Use of SAML allows customers to use their own corporate login credentials to authenticate to Resilient.

    Duration: 8 minutes
    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    10m      Intermediate
    Using Resilient disaster recovery health checks

    Overview

    This video shows how to use the Resilient Disaster Recovery Health Monitoring. DR Health Monitoring involves setting and fine-tuning values in the group_vars/all file.

    Agenda

    • Introduction
    • Syslog configuration
    • Health monitoring settings
    Closed captions: English, French, German, Spanish and Japanese

    De En Es Fr Ja
    6m      Intermediate