• Identify the components needed for XDR deployment
• Determine which data sources are most useful for detection and investigation
• Search log events across the enterprise
• Locate and use critical information in an XDR alert to assess a potential threat

Day 1

Helix Fundamentals

• Introducing Helix
• Features and capabilities
• Searching and pivoting
• Event parsing
• Custom dashboards

Data Sources

• Data Source Visibility
• Cloud Data Sources
• On-premises Data Sources
• Data Source Configuration
• Unparsed Data
• Trellix Audit Data
• Audit Policies

Search and Trellix Query Language (TQL)

• Searchable fields
• Anatomy of a TQL search
• TQL search, directories, and transform clauses

Custom Dashboards, Reports, and Lists

• Custom Dashboards
• Reports
• Lists

Day 2

Threat Trends, Data Source Selection, and Mitre ATT&CK

• Data sources for detection and investigation
• Attack models to frame data source selection
• Using the MITRE ATT&CK framework
• Mapping attacker activity to the stages of an APT attack

Rules

• Best practices for writing rules
• Creating and enabling rules
• Creating and using lists
• Using regular expressions in rules
• Multi-stage rules

Initial Alerts

• Threats and Alert correlations
• Helix Alerts
• Building Alert Context
• Intel Hits
• Trellix Detections
  • MVision
  • Endpoint Security (HX)
  • MVX and Network Security (NX)

Helix Case Management

• Creating a case in Helix
• Adding events to a case
• Case workflow

Network security professionals, incident responders and Trellix administrators and analysts who use XDR to analyze data in noisy event streams.

A working understanding of networking and network security, the Windows operating system, file system, registry, and use of the command line interface (CLI).