Ansible Security Automation Workshop for Charter Communications

The workshop is designed for technical professionals in automation (part of a cross-functional team or supporting other vertical teams in their company), security operations and vulnerability management. No previous knowledge about Ansible is required to access this workshop, though it certainly helps.

The workshop shows, step by step, how you can reach security automation goals using Ansible to orchestrate the following three investigation and response activities involving multiple security tools: 

• An enterprise firewall (CheckPoint Next Generation Firewall)
• An intrusion detection system (Snort)
• A SIEM (Splunk Enterprise Security)

Topics

• Introduction to Ansible Security Automation
• How Ansible integrates with security products
• Explore the lab environment:
  • Ansible execution host
  • Enterprise Firewall: Check Point Next Generation Firewall
  • IDS: Snort
  • SIEM: Splunk Enterprise Security
• Automate security platforms:
  • Execute your first security automation playbook - meet Check Point NGFW
  • Execute a security automation playbook targeting Snort IDS
  • Execute a security automation playbook targeting Splunk ES
• Tie the 3 technologies together:
  • Use case 1: Detection and triage of suspicious activities
  • Use case 2: Threat hunting<
  • Use case 3: Incident response
• Wrap it all up

Virtual workshop details: