VMware Carbon Black EDR Advanced Analyst

Cieľová skupina

Táto časť nie je lokalizovaná

System administrators and security operations personnel, including analysts and managers

Štruktúra kurzu

Táto časť nie je lokalizovaná

Course Introduction

• Introductions and course logistics
• Course objectives

VMware Carbon Black EDR & Incident Response

• Framework identification and process

Preparation

• Implement the Carbon Black EDR instance according to organizational requirements

Identification

• Use initial detection mechanisms
• Process alerts
• Proactive threat hunting
• Incident determination

Containment

• Incident scoping
• Artifact collection
• Investigation

Eradication

• Hash banning
• Removing artifacts
• Continuous monitoring

Recovery

• Rebuilding endpoints
• Getting to a more secure state

Lessons Learned

• Tuning Carbon Black EDR
• Incident close out