VCBEDRAAN: VMware Carbon Black EDR Advanced Analyst
VCBEDRAAN: VMware Carbon Black EDR Advanced Analyst
Overview
Duration: 1.0 day
This one-day course teaches you how to use the VMware Carbon Black® EDR™ product during incident response. Using the SANS PICERL framework, you will configure the server and perform an investigation on a possible incident. This course provides guidance on using Carbon Black EDR capabilities throughout an incident with an in-depth, hands-on, scenario-based lab.
Objectives
By the end of the course, you should be able to meet the following objectives:
- Utilize Carbon Black EDR throughout an incident
- Implement a baseline configuration for Carbon Black EDR
- Determine if an alert is a true or false positive
- Fully scope out an attack from moment of compromise
- Describe Carbon Black EDR capabilities available to respond to an incident
- Create addition detection controls to increase security
Content
Course Introduction
- Introductions and course logistics
- Course objectives
VMware Carbon Black EDR & Incident Response
- Framework identification and process
Preparation
- Implement the Carbon Black EDR instance according to organizational requirements
Identification
- Use initial detection mechanisms
- Process alerts
- Proactive threat hunting
- Incident determination
Containment
- Incident scoping
- Artifact collection
- Investigation
Eradication
- Hash banning
- Removing artifacts
- Continuous monitoring
Recovery
- Rebuilding endpoints
- Getting to a more secure state
Lessons Learned
- Tuning Carbon Black EDR
- Incident close out
Audience
Security operations personnel, including analysts and incident responders
Prerequisites
This course requires completion of the following course:
- VMware Carbon Black EDR Administrator
Lịch khai giảng
Form đăng ký
Các khóa đào tạo Khóa học VMware khác
Cơ hội nhận ưu đãi học phí lên tới 60%
Đăng ký tư vấn
cùng đội ngũ chuyên gia Trainocate!!
Xác nhận gửi thành công
Cảm ơn bạn đã để lại thông tin.
Đội ngũ chuyên gia của Trainocate đang trong quá trình xác nhận thông tin và sẽ kết nối với bạn trong vòng 24 giờ.
Bản quyền thuộc về Trainocate Việt Nam