1 Course Introduction
- Introductions and course logistics
- Course objectives
2 Planning and Architecture
- Describe the architecture and components of Carbon Black EDR
- Explain single and cluster server requirements
- Identify the communication requirements for Carbon Black EDR
3 Server Installation, Upgrade, and Administration
- Install the Carbon Black EDR server
- Describe the options during the installation process
- Install a Carbon Black EDR sensor
- Confirm data ingestion in the Carbon Black EDR server
- Identify built-in administration tools
- Manage sensor groups
- Manage users and teams
4 Exploring Server Datastores
- Describe the datastores used in Carbon Black EDR
- Interact with the available datastores
5 Performing Live Query
- Describe live query capabilities
- Perform queries across endpoints
6 Searching and Best Practices
- Describe the capabilities and data available in the process search
- Perform process searches to find specific endpoint activity
- Describe the capabilities and data available in the binary search
- Perform binary searches to find application data
- Describe the query syntax and advanced use cases
- Perform advanced queries across the dataset
7 Threat Intelligence Feeds and Watchlists
- Define Threat Intelligence Feeds
- Manage the available Threat Intelligence Feeds
- Describe the use of Watchlists
- Manage Watchlists in the environment
8 Connectors in VMware Carbon Black EDR
- Configure connectors in Carbon Black EDR
- Troubleshoot connectors
9 Troubleshooting VMware Carbon Black EDR
- Identify the available troubleshooting scripts in the Carbon Black EDR server
- Run troubleshooting scripts to identify problems
- Generate a sensor log bundle
- Identify the location of sensor registry keys
10 Head-Up Display Page Overview
- Identify panels relating to endpoint data
- Analyze endpoint data provided by the panels
- Identify panels relating to operations data
- Analyze operations data provided by the panels
- Identify panels relating to server data
- Analyze server data provided by the panels
- Define alert generation in Carbon Black EDR
- Manage alerts
11 Performing Investigations
- Describe investigations
- Explore data used in an investigation
- Manage investigations
- Manage investigation events
12 Responding to Endpoint Incidents
- Describe isolation in Carbon Black EDR
- Manage isolating endpoints
- Describe live response capabilities
- Manage live response sessions
- Describe hash banning
- Manage banned hashes
13 Overview of Postman and the VMware Carbon Black EDR API
- Explain the use of the API
- Differentiate the APIs available for Carbon Black EDR
- Explain the purpose of API tokens
- Create an API token
- Explain the API URL
- Create a valid API request
- Import a collection to Postman
- Initiate an API request from Postman
- Perform operations manually using Postman
- Analyze the use cases for Postman
- Show basic automation tasks using the API and curl
- Compare the usage of curl with Postman
