ArcSight n00b Part2: Skillset Prereq

So you want to get into ArcSight, but don’t know what skills you should have to even start?  At an organization I worked for we had a hard time hiring ArcSight Engineers/Administrators.  There are not many people with actual ArcSight experience beyond use of the client side console.  So we started looking for individuals that might be able to learn the system quickly.  Based on some of the people we hired here are some prerequisites that might help you to start in ArcSight:

Linux/Unix – Although ArcSight ESM/Database works on Windows, the Linux/Unix systems have a serious learning curve.  You need to have a strong grasp of the basics if your ArcSight ESM or Database is on a Linux/Unix OS.  Basic commands to traverse a directory, copying, pasting, finding and manipulating data, user and group manipulation on the command line is a necessity.  All of this is more transparent on a Windows system, but in a Linux/Unix environment its best to have some experience.  Some scripting experience is helpful but not absolutely necessary.  I would say the the level of knowledge is Comptia Linux+ if the system is in a linux OS.  The more comfortable you are with linux that the better.

HP ArcSight 5.2 Operates on these operating systems:

Microsoft Windows
Server 2003 R2
(SP2) 32-bit
Microsoft Windows
Server 2003 R2
(SP2) 64-bit
Microsoft Windows
Server 2008 R2
SP2 64-bit

Red Hat Enterprise
Linux 5 (RHEL 5.7)
32-bit
Red Hat Enterprise
Linux 5 (RHEL 5.7)
64-bit
Red Hat Enterprise
Linux 6.1 64-bit
SUSE Linux 11
Enterprise Server
64-bit

IBM AIX 5L,
Version 5.3
(5.3.0.70) 64-bit
IBM AIX 6L, 6.1
64- bit

Oracle DBA – HP ArcSight ESM 6.x has moved to a database called CORR.  But most current (circa 2013) ESM/DB implementations will have an Oracle back end.  This is sure to change within about 3 years as more people go to CORR.  I would say low level DBA Oracle skills is very necessary.  Once you start installing and understanding ArcSight you see that its just a database with a complex user interface that allows intricate manipulation of how the data is viewed.. its SQL with a fancy user interface.  As an ArcSight Engineer, you will have to face Oracle at some point.  Be ready!  Skills necessary are starting, stopping the database, doing simple SQL commands, understanding how Oracle works with ArcSights ESM front in, basic trouble shooting and managing database user accounts.  If you have a DBA on staff that is great, but you will still need to know some basics.

More info on CORR:

HP ArcSight’s Correlation Optimized
Retention and Retrieval (CORR) Engine is a
breakthrough technology that delivers orders
of magnitude improvement in log correlation
and storage, helping security administrators
thwart the complex threats they face today.

–HP ArcSight Express

Security Analyst – ArcSight has two separate tracks / bodies of knowledge:  HP ArcSight Security Analyst & HP ArcSight Administrator/Engineer.  These two bodies of knowledge do have some cross over, but each goes very deep into their own dimensions.  For example, an HP ArcSight Security Analyst does not need to know anything about Oracle installation and troubleshooting and still be a great analyst, and the HP ArcSight Engineer does not need to know how to analyze a TCP/IP packet using a protocol analyzer.

A security analyst will be familiar with many tools of their trade:  packet sniffers, network scanners, IDS/IPS (host and/or network based) and they should have a strong understanding of how networks and TCP/IP work.  The ArcSight Security Analyst should know how to look at a TCP/IP packet and figure out the source/destination and potential nature of a packet in the context of a given network.  They should be able to use the ArcSight Console, create reports, active channels and use the ArcSight Logger.  A huge benefit would be to know how to create ArcSight content (aka rules).  For some sort of baseline of knowledge base: CEH, CISSP, GCIA.

Other skills might include:

Networking / Security – Since ArcSight is collecting security logs over a network both computer security skills and skills in networking are helpful.  More specifically, having experience with hardening workstations and/or servers, understanding the why security policies are important to organizations and hands-on experience with system security in a medium to large operational environment will give a good exposure to security.  Knowledge base level might be somewhere between a Security+ and a CISSP.  As for networking, the basics are needed for an ArcSight Engineer/Administrator because you must integrate ArcSight into a local area network.  So you need to understand basic ip addressing, how to use tools for troubleshooting connectivity, ip subnetting,  and how TCP/IP works.  So you don’t need to be a CCNA or even a CCENT because you are not configuring switches and routers but something like the skillset of Comptia Network+ would do.

Storage – Surprisingly enough knowledge of storage might come in handy.  Because in a large environment where lots of data are collected in a database your organization will likely use a storage device of some sort.  ArcSight works better with certain storage devices.  This is important information for an ArcSight Engineer because storage can directly affect the performance that the customer sees.

These are just some of the prerequisites that I have found helpful but of course nothing beats actual ArcSight Engineering/Admin/Analyst experience when looking for an ArcSight professional  and this is good to keep in mind as you dig deeper into ArcSight.  The “unicorn” ArcSight candidate is the one that has worked for the company, (HP) ArcSight.