Alert Analysis and Investigations with Network Security and Endpoint Security (HX) Course Training

This course examines how to triage alerts generated by the Trellix Network Security and Endpoint Security (HX) platforms, derive actionable information from those alerts, and inspect affected endpoints using live analysis and investigation fundamentals.Hands-on activities span the entire analysis and live investigation process, beginning with a Trellix-generated alert, leading to discovery and analysis of the host for evidence of malware and other unwanted intrusion. Endpoint analysis focuses on investigation techniques using features of Endpoint Security (HX), such as the Triage Summary, Audit Viewer, and Acquisitions.

Recognize current malware threats and trends
Interpret alerts from Network Security and Endpoint Security (HX) products
Locate and use critical information in Trellix alerts to assess a potential threat
Define indicators of compromise based on an alert and identify compromised hosts
Describe methods of live analysis
Create and request data acquisitions to conduct an investigation
Define common characteristics of Windows processes and services
Investigate a data collection from Endpoint Security (HX) using a defined methodology
Identify malicious activity hidden among common Windows events

Day 1

Threats and Malware Trends

Threat landscape
Attack motivations
MITRE ATT&CK framework
Emerging threat actors

Initial Alerts

Endpoint Security (HX) alerts
Triage with Triage Summary
Network Security alerts
Identifying forensic artifacts in the OS Change Detail

MVX Alerts

Trellix alert types
Identifying forensic artifacts in the OS Change Detail
Callbacks
SmartVision
Threat assessment

Day 2

Using Audit Viewer and Redline®

Access triage and data collections for hosts
Navigate a triage collection or acquisition using Redline® or Audit Viewer
Apply tags and comments to a triage collection to identify key events

Windows Telemetry and Acquisitions

Live forensic overview
Windows telemetry
Acquiring data

Day 3

Acquisitions

Triage and real-time events
Live system acquisitions
Bulk acquisitions
Endpoint Security (HX) REST API

Modules

Administration
Detection and protection
Response

Day 4

Investigation Methodology

MITRE ATT&CK framework
Mapping evidence to attacker activity

Capstone: Capture the Flag (CTF)

This course is intended for security analysts, incident responders, and threat hunters who use Network Security or Endpoint Security (HX) to detect, investigate, and prevent cyber threats.

Students taking this course should have a working knowledge of Windows operating systems, networking and network security, file system, registry and regular expressions, and experience scripting in Python.

Overview

Objective

Recognize current malware threats and trends
Interpret alerts from Network Security and Endpoint Security (HX) products
Locate and use critical information in Trellix alerts to assess a potential threat
Define indicators of compromise based on an alert and identify compromised hosts
Describe methods of live analysis
Create and request data acquisitions to conduct an investigation
Define common characteristics of Windows processes and services
Investigate a data collection from Endpoint Security (HX) using a defined methodology
Identify malicious activity hidden among common Windows events

Outline

Day 1

Threats and Malware Trends

Threat landscape
Attack motivations
MITRE ATT&CK framework
Emerging threat actors

Initial Alerts

Endpoint Security (HX) alerts
Triage with Triage Summary
Network Security alerts
Identifying forensic artifacts in the OS Change Detail

MVX Alerts

Trellix alert types
Identifying forensic artifacts in the OS Change Detail
Callbacks
SmartVision
Threat assessment

Day 2

Using Audit Viewer and Redline®

Access triage and data collections for hosts
Navigate a triage collection or acquisition using Redline® or Audit Viewer
Apply tags and comments to a triage collection to identify key events

Windows Telemetry and Acquisitions

Live forensic overview
Windows telemetry
Acquiring data

Day 3

Acquisitions

Triage and real-time events
Live system acquisitions
Bulk acquisitions
Endpoint Security (HX) REST API

Modules

Administration
Detection and protection
Response

Day 4

Investigation Methodology

MITRE ATT&CK framework
Mapping evidence to attacker activity

Capstone: Capture the Flag (CTF)

Target audience

This course is intended for security analysts, incident responders, and threat hunters who use Network Security or Endpoint Security (HX) to detect, investigate, and prevent cyber threats.

Prerequisites

Termine

Datum auf Anfrage

Cisco-Ausbildung

Cisco Zertifizierungen

Cisco Learning Credits

Cisco Continuing Education

Cisco Digital Learning

Cisco Business Enablement

Cisco Schulungskatalog

Technische Zertifizierung

Fortinet-Ausbildung

Fortinet Schulungskatalog

ATC Status

Fortinet Service-Pakete

Microsoft-Ausbildung

Extreme-Ausbildung

Technische Zertifizierung

Extreme Schulungskatalog

ATP-Akkreditierung

Lösungen & Dienstleistungen

Über uns

Alert Analysis and Investigations with Network Security and Endpoint Security (HX)

Termine

Follow Up Courses

Database Security Administration

Alert Analysis and Investigations with Network Security

Trellix Intelligent Sandbox with DXL and TIE Administration

Intrusion Prevention System Administration

Endpoint Security Expert Rules Creation – Advanced

Endpoint Security (HX) Administration

Mvision Endpoint + Mvision ePO Admin

Endpoint Detection and Response Administration

Trellix Endpoint with ePolicy Orchestrator – SaaS Administration

Endpoint Security Expert Rules Course

Know someone who´d be interested in this course?
Let them know...

Adresse

Verbinde

Cisco-Ausbildung

Cisco Zertifizierungen

Cisco Learning Credits

Cisco Continuing Education

Cisco Digital Learning

Cisco Business Enablement

Cisco Schulungskatalog

Technische Zertifizierung

Fortinet-Ausbildung

Fortinet Schulungskatalog

ATC Status

Fortinet Service-Pakete

Microsoft-Ausbildung

Extreme-Ausbildung

Technische Zertifizierung

Extreme Schulungskatalog

ATP-Akkreditierung

Lösungen & Dienstleistungen

Über uns

Alert Analysis and Investigations with Network Security and Endpoint Security (HX)

Termine

Follow Up Courses

Database Security Administration

Alert Analysis and Investigations with Network Security

Trellix Intelligent Sandbox with DXL and TIE Administration

Intrusion Prevention System Administration

Endpoint Security Expert Rules Creation – Advanced

Endpoint Security (HX) Administration

Mvision Endpoint + Mvision ePO Admin

Endpoint Detection and Response Administration

Trellix Endpoint with ePolicy Orchestrator – SaaS Administration

Endpoint Security Expert Rules Course

Know someone who´d be interested in this course? Let them know...

Know someone who´d be interested in this course?
Let them know...