Ansible Security Automation Workshop

Who is this workshop best for?

The workshop is intended as an introductory course for Ansible® Security Automation designed for people who want to learn how Ansible can be leveraged in security environments. The intended audience is technical professionals in automation (part of a cross-functional team or supporting other vertical teams in their company), security operations and vulnerability management. There is no previous knowledge about Ansible required to access this workshop, though it certainly helps.

Description

This workshop shows, step by step, how you can reach this goal using Ansible to orchestrate three investigation and response activities involving multiple security tools -  an enterprise firewall (CheckPoint Next Generation Firewall), an intrusion detection system (Snort) and a SIEM (IBM QRadar).

Agenda

• Introduction to Ansible Security Automation
• Understanding Ansible modules, tasks & playbooks
• Using Ansible with security tools:
  • Check Point NGFW
  • Snort IDS
  • IBM QRadar
• Automating Popular Security Use Cases:
  • Investigation Enrichment
  • Threat hunting
  • Incident response