Lesson 3: Securing Email with Cisco Email Security Appliance (SESA) v3.1 – Monitoring, Threat Hunting, Investigation, and Response

This lesson provides guided coverage of monitoring, threat hunting, investigation, and response within the Securing Email with Cisco Email Security Appliance (SESA) v3.1 Training.

Topics Covered

• Security events, alerts, dashboards, logs, telemetry, and evidence collection
• Traffic analysis, intrusion events, malware indicators, and behavioral context
• Threat hunting hypotheses, queries, correlations, and investigation workflow
• Incident triage, containment, escalation, documentation, and response actions
• Compliance monitoring, reporting, audit evidence, and policy exceptions
• Integration with security tools, APIs, automation, and ticketing
• Scenario-based investigation and response exercise

Practical Outcome

Learners complete the lesson with a clear understanding of the workflow, the ability to validate the expected result, and a structured approach to common troubleshooting tasks.