Ridgeback Fundamentals and Deployment
RB-101 introduces Ridgeback architecture and deployment models, installation and configuration, and core interface functions. Participants explore endpoint and event visibility, identify rogue devices, create basic alerting policies, and use historical data for introductory forensic investigations.
- Total Length 4.5 Hours
- 4Course Modules 4Practical Exercises
Course Objectives
Understand the Ridgeback architecture, components, and basic deployment models.
Learn how to install and configure the Ridgeback database, container services, and R-cores.
Become familiar with system requirements, basic UI navigation, and initial configuration tasks.
Understand basic concepts of network visibility, rogue device detection, and automated monitoring that Ridgeback provides.
Introduction to Ridgeback
45 min- Overview of Ridgeback's purpose: reducing chaos, providing visibility, real-time security insights.
- Ridgeback architecture: database, container services, R-core.
- Deployment models: single laptop, standalone server, enterprise-ready.
- Set up a Ridgeback environment on a laptop or VM.
System Requirements & Installation
45 min- System prerequisites (database options, container runtime, R-core requirements).
- Installing Ridgeback services and database configuration.
- Logging setup and policies for data retention.
- Install and configure the database (e.g., MySQL/MariaDB) and container services.
- Install and configure an R-core.
- Configure email (if available).
- Configure DNS (if available).
- Create the initial superadmin account.
Ridgeback UI & Basic Usage
45 min- Logging into Ridgeback, user permissions and roles.
- Navigating the UI: viewing endpoints, events, policies.
- Intro to managed vs. unmanaged devices, event logs, and initial alerts.
- Log into the Ridgeback interface, browse endpoints and events.
- Reconcile DNS entries (if available).
- Identify insecure hostname queries.
- Identify rogue devices.
- Identify the accessible services.
- Extract event logs for correlation with a SIEM (if available).
- Practice identifying indicators of potential network reconnaissance.
Policies, Notifications & Basic Forensics
45 min- Creating basic policies for alerting on suspicious endpoints.
- Understanding event tags, time windows, triggers.
- Introduction to using Ridgeback data for initial forensic investigations.
- Configure a simple trigger to alert on endpoints contacting unused IP addresses.
- Adjust notification settings and confirm that Ridgeback generates alerts.
- Use Ridgeback's historical data to investigate a suspicious event.
