Course Overview
This one-day course teaches you how to use the VMware Carbon Black® EDR™ product during incident response. Using the SANS PICERL framework, you will configure the server and perform an investigation on a possible incident. This course provides guidance on using Carbon Black EDR capabilities throughout an incident with an in-depth, hands-on, scenariobased lab.
Course Objectives
By the end of the course, you should be able to meet the following objectives:
Utilize Carbon Black EDR throughout an incident
Implement a baseline configuration for Carbon Black EDR
Determine if an alert is a true or false positive
Fully scope out an attack from moment of compromise
Describe Carbon Black EDR capabilities available to respond to an incident
Create addition detection controls to increase security
- Top-rated instructors: Our crew of subject matter experts have an average instructor rating of 4.8 out of 5 across thousands of reviews.
- Authorized content: We maintain more than 35 Authorized Training Partnerships with the top players in tech, ensuring your course materials contain the most relevant and up-to date information.
- Interactive classroom participation: Our virtual training includes live lectures, demonstrations and virtual labs that allow you to participate in discussions with your instructor and fellow classmates to get real-time feedback.
- Post Class Resources: Review your class content, catch up on any material you may have missed or perfect your new skills with access to resources after your course is complete.
- Private Group Training: Let our world-class instructors deliver exclusive training courses just for your employees. Our private group training is designed to promote your team’s shared growth and skill development.
- Tailored Training Solutions: Our subject matter experts can customize the class to specifically address the unique goals of your team.
Course Prerequisites
There are no prerequisites for this course.
Agenda
1 - Course Introduction
- Introductions and course logistics
- Course objectives
2 - VMware Carbon Black EDR & Incident Response
- Framework identification and process
3 - Preparation
- Implement the Carbon Black EDR instance according to organizational requirements
4 - Identification
- Use initial detection mechanisms
- Process alerts
- Proactive threat hunting
- Incident determination
5 - Containment
- Incident scoping
- Artifact collection
- Investigation
6 - Eradication
- Hash banning
- Removing artifacts
- Continuous monitoring
7 - Recovery
- Rebuilding endpoints
- Getting to a more secure state
8 - Lessons Learned
- Tuning Carbon Black EDR
- Incident close out