Exabeam Admin study plan

Map the New-Scale platform component stack - data collectors, pipeline, correlation/analytics engine, storage tiers, and presentation layer - into a one-page architecture diagram you draw from memory.

Compare cloud-native versus self-hosted deployment models by listing at least six decision criteria (data residency, scaling, upgrade cadence, cost model, HA/DR, operational ownership) and stating which model wins on each.

Identify the minimum viable hardware or instance sizing inputs (EPS, retention days, hot vs cold storage split, concurrent analyst count) and write the sizing formula you would use in a customer conversation.

Distinguish where the LogRhythm SIEM role ends and the Exabeam analytics role begins in a hybrid architecture, and describe the data handoff point between them.

Trace a single log event end-to-end through the pipeline - collection, parsing/normalization, enrichment, indexing, retention - and annotate each stage with the failure modes that break it.

Configure at least two distinct log source types (one syslog-based, one API-pull) in a lab or sandbox and confirm events arrive with correct timestamps and parsed fields.

Explain the difference between raw retention and normalized retention, and calculate storage impact for a given EPS at 30/90/365-day tiers.

Document the health metrics you would monitor for collectors and pipeline throughput, and set a threshold for each.

Write and test at least three custom parsers or field-extraction rules for non-standard log formats, validating against sample events.

Define a log source onboarding checklist that includes timezone handling, event categorization, and duplicate-suppression checks.

Diagnose three common ingestion failures (clock skew, dropped events under burst, parser mismatch) and write the remediation steps for each.

Build a retention and archiving policy statement that maps log categories to required retention periods and storage tiers.

Describe how baseline behavior models are built for users and entities, including the learning window and what invalidates a baseline.

Configure at least one UEBA use case end-to-end - select the risk-relevant behaviors, set the scoring weight, and define the alert threshold.

Explain Agent Behavior Analytics (ABA) conceptually: what an AI agent or non-human identity looks like as an entity, and which behaviors (tool invocation patterns, privilege escalation, anomalous data access) warrant detection.

Tune one rule to reduce false positives and document the before/after alert volume.

Build a threat detection rule from scratch that combines a UEBA risk signal with a deterministic correlation condition.

Walk a simulated incident through the timeline view, reconstructing the sequence of events and identifying the initial access point.

Map at least three detections to a recognized framework (MITRE ATT&CK technique IDs) and note the coverage gaps you find.

Draft the triage questions an analyst should answer in the first five minutes of an alert, ordered by decision value.

Describe how AI-assisted investigation workflows surface correlated evidence, and state where human review must remain mandatory.

Design a SOAR playbook that automates enrichment and containment for one alert type, specifying trigger, actions, approval gates, and rollback.

Identify the failure conditions that should halt an automated playbook (low confidence, destructive action, missing asset context) and encode them as guardrails.

Write the escalation path from automated triage to Tier 2 analyst, including what evidence travels with the handoff.

Define the outcome metrics you would report to leadership - MTTD, MTTR, detection coverage, alert-to-incident ratio - and state the data source for each.

Configure a dashboard or report in Outcomes Navigator that tracks at least three of those metrics over time.

Translate a technical detection gap into a business-risk statement a non-technical executive can act on.

Build a quarterly security program review outline that ties platform usage to measurable risk reduction.

Configure role-based access control with at least three roles (admin, analyst, read-only auditor) and verify least-privilege boundaries.

Document the support escalation path and the diagnostic artifacts (logs, config exports, timestamps) to collect before opening a case.

Run a full timed practice assessment across all seven domains and log every missed question by domain.

Re-review your weakest two domains using the artifacts you built in weeks 1–7, then re-test only those areas.