Intrusion Detection Concepts

 Identify features and fuctions on an IDP sensor

 Identify the uses of the IDP interfaces

 Identify TCP ports used by IDP sensor and Security Manager

Understand the IDP deployment modes

Initial Configuration of an IDP Sensor

Identify the steps to deploy the IDP Sensor

 Describe how to configure a new sensor via the console

 Describe how to establish communication between Security Manager and the IDP sensor

Configuring and Fine-Tuning Policies

Match IDP attack terminology to their associated definitions

Understand the components of an IDP rule

Choose appropriate IDP actions and IP actions

 Describe the IDP rule-matching algorithm

 Explain the use of packet captures

Explain how to fine-tune policies

Configuring Other IDP-related Rulebases

 Explain Exempt rulebase operation

Explain Traffic Anomliesrulebase operation

 Explain Backdoor rulebase operation

Explain SYN Protector rulebase operation

Explain Network Honeypot operation

Configuring and Using the Profiler

Describe the general operation of the Profiler

List the steps to operate the Profiler

Describe how to use Profiler for network discovery

 Describe how to use Profiler to detect new devices and ports

Describe how to use Profiler to detect policy violations

Sensor Operation and Sensor Command-line Utilities

 Describe the sensor components and sensor processes

 Use scio to manage policies and view sensor configuration

Use sctop to view sensor statistics

Managing Attack Objects and Creating Custom Signatures

 Describe the use of static groups vs. dynamic groups

Explain how to update the attack object database

 List the steps for obtaining information on an attack

Understand the purpose and use of the sensor commands “scioccap” and “sciopcap”

List the steps for creating a simple attack object

Describe the purpose of compound attack objects

Maintenance and Troubleshooting

Use Appliance Configuration Manager (ACM) to view and change sensor configuration

 Use sensor commands and Unix commands to troubleshoot IDP problems

 Understand the operation of external HA and NIC bypas