COURSE LIST / COURSE BY TECHNOLOGY VENDORS / VMWARE

VMware Carbon Black EDR Advanced Analyst

Course Summary:

This one-day course teaches you how to use the VMware Carbon Black® EDR™ product during incident response. Using the SANS PICERL framework, you will configure the server and perform an investigation on a possible incident. This course provides guidance on using Carbon Black EDR capabilities throughout an incident with an in-depth, hands-on, scenario-based lab.

Course Duration: 1 day

Course Content:

1 Course Introduction

Introductions and course logistics
Course objectives

2 VMware Carbon Black EDR & Incident Response

Framework identification and process

3 Preparation

Implement the Carbon Black EDR instance according to organizational requirements

4 Identification

Use initial detection mechanisms
Process alerts
Proactive threat hunting
Incident determination

5 Containment

Incident scoping
Artifact collection
Investigation

6 Eradication

Hash banning
Removing artifacts
Continuous monitoring

7 Recovery

Rebuilding endpoints
Getting to a more secure state

8 Lessons Learned

Tuning Carbon Black EDR
Incident close out