Cisco-opplæring

Insoft Services er en av få opplæringsleverandører i EMEAR som tilbyr hele spekteret av Cisco-sertifisering og spesialisert teknologiopplæring.

Les mer

Cisco Sertifisering

Opplev en blandet læringstilnærming som kombinerer det beste av instruktørledet opplæring og e-læring i eget tempo for å hjelpe deg med å forberede deg til sertifiseringseksamen.

Les mer

Cisco Learning Credits

Cisco Learning Credits (CLC) er forhåndsbetalte opplæringskuponger innløst direkte med Cisco som gjør planleggingen for suksessen din enklere når du kjøper Cisco-produkter og -tjenester.

Les mer

Etterutdanning

Cisco Continuing Education Program tilbyr alle aktive sertifiseringsinnehavere fleksible alternativer for å resertifisere ved å fullføre en rekke kvalifiserte opplæringselementer.

Les mer

Cisco Digital Learning

Sertifiserte ansatte er verdsatte eiendeler. Utforsk Ciscos offisielle digitale læringsbibliotek for å utdanne deg gjennom innspilte økter.

Les mer

Cisco Business Enablement

Cisco Business Enablement Partner Program fokuserer på å skjerpe forretningsferdighetene til Cisco Channel Partners og kunder.

Les mer

Cisco opplæringskatalog

Les mer

Fortinet Sertifisering

Fortinet Network Security Expert (NSE)-programmet er et opplærings- og sertifiseringsprogram på åtte nivåer for å lære ingeniører om nettverkssikkerheten for Fortinet FW-ferdigheter og -erfaring.

Tekniske kurs

Fortinet-opplæring

Insoft er anerkjent som Fortinet Autorisert Opplæringssenter på utvalgte steder i EMEA.

Les mer

Fortinet opplæringskatalog

Utforsk et bredt utvalg av Fortinet Schedule på tvers av forskjellige land så vel som online kurs.

Les mer

ATC-status

Sjekk atc-statusen vår på tvers av utvalgte land i Europa.

Les mer

Pakker for Fortinet-tjenester

Insoft Services har utviklet en spesifikk løsning for å effektivisere og forenkle prosessen med å installere eller migrere til Fortinet-produkter.

Les mer

Microsoft-opplæring

Insoft Services gir Microsoft opplæring i EMEAR. Vi tilbyr Microsofts tekniske opplærings- og sertifiseringskurs som ledes av instruktører i verdensklasse.

Tekniske kurs

Extreme-opplæring

Lær eksepsjonell kunnskap og ferdigheter i ekstreme nettverk.

Les mer

Teknisk sertifisering

Vi tilbyr omfattende læreplan over tekniske kompetanseferdigheter om sertifiseringsprestasjonen.

Les mer

Extreme opplæringskatalog

Tekniske kurs

ATP-akkreditering

Som autorisert opplæringspartner (ATP) sørger Insoft Services for at du får de høyeste utdanningsstandardene som er tilgjengelige.

Les mer

Løsninger og tjenester

Vi tilbyr innovativ og avansert støtte for design, implementering og optimalisering av IT-løsninger. Vår kundebase inkluderer noen av de største Telcos globalt.

Les mer

Globalt anerkjent team av sertifiserte eksperter hjelper deg med å gjøre en jevnere overgang med våre forhåndsdefinerte konsulent-, installasjons- og migrasjonspakker for et bredt spekter av Fortinet-produkter.

Om oss

Insoft Tilbyr autoriserte opplærings- og konsulenttjenester for utvalgte IP-leverandører. Finn ut hvordan vi revolusjonerer bransjen.

Les mer
  • +47 23 96 21 03
  • Investigations with Helix, Network and Endpoint Bundle (Helix, HX, NX)

    Duration
    4 Dager
    Delivery
    (Online Og På stedet)
    Price
    Pris på forespørsel

    This course covers the XDR workflow, including configuring data sources through extended detection via Trellix Helix, Trellix Network Security, and Trellix Endpoint Security (HX). Learners triage Trellix-generated alerts, derive actionable information from those alerts, and inspect affected endpoints using live analysis and investigation fundamentals.

     

    Hands-on activities include writing TQL searches, creating rules, analyzing and validating alerts from Helix, Network Security, and Endpoint Security (HX), deep analysis of endpoint data collections, and response actions through Endpoint Security (HX) such as collecting data from across the enterprise and containing endpoints.

    • Identify the components needed to deploy Trellix Helix, Network Security, and Endpoint Security (HX)
    • Determine which data sources are most useful for Helix detection and investigation
    • Locate and use critical information in a Helix alert to assess a potential threat
    • Comfortably pivot from the Helix web console to native Trellix tools for deep analysis
    • Validate Network Security and Endpoint Security (HX) alerts
    • Use specialized features of Network Security and Endpoint Security (HX) to investigate and respond to potential threats across enterprise systems and endpoints

    Day 1

    Helix Fundamentals

    • Helix Overview
    • Features and Capabilities
    • Searching and Pivoting
    • 3rd Party Data Sources
    • Custom Dashboards

    Data Sources

    • Cloud Data Sources
    • On-premises Data Sources
    • Data Access

    Custom Dashboards, Reports, and Lists

    • Custom Dashboards
    • Reports
    • Lists

    Search and Trellix Query

    • Language (TQL)
    • Searchable Fields
    • Anatomy of an MQL Search
    • MQL Search, Directive, and Transform Clauses

    Day 2

    Rules

    • Creating and Enabling Rules
    • Using Regular Expressions in Rules
    • Helix Analytics
    • Multi-stage Rules

    Initial Alerts

    • Helix Alerts
    • Guided Investigations
    • Endpoint Security (HX) Alerts
    • Network Security Alerts

    Helix Case Management

    • Creating a Case in Helix
    • Adding Events to a Case
    • Case Workflow

    Day 3

    Data Sources, Trends, and the Attack Lifecycle

    • Threat Landscape
    • Attack Motivations
    • MITRE ATT&CK Framework
    • Emerging Threat Actors

    Using Audit Viewer and Redline®

    • Access Triage and Data Collections for Hosts
    • Navigate a Triage Collection or Acquisition using Audit Viewer
    • Apply Tags and Comments to a Triage Collection to Identify Key Events

    Windows Telemetry and Acquisitions

    • Live Forensic Overview
    • Windows Telemetry
      • Memory Artifacts
      • System Information
      • Processes
      • File System
      • Configuration Files
      • Services
      • Scheduled Tasks
      • Logging
    • Acquiring Data

    Day 4

    Investigation Methodology

    • MITRE ATT&CK Framework
    • Mapping Evidence to Attacker Activity
      • Evidence of Initial Compromise
      • Evidence of Persistence
      • Evidence of Lateral Movement
      • Evidence of Internal Reconnaissance
      • Evidence of Data Exfiltration

    Capstone: Capture the Flag (CTF)

    Security analysts, incident responders, and threat hunters who use Helix, Network Security and Endpoint Security (HX) to detect, investigate, and prevent cyber threats.

    Students taking this course should have a working understanding of networking and network security, the Windows operating system, file system, registry, and use of the command line interface (CLI).

    This course covers the XDR workflow, including configuring data sources through extended detection via Trellix Helix, Trellix Network Security, and Trellix Endpoint Security (HX). Learners triage Trellix-generated alerts, derive actionable information from those alerts, and inspect affected endpoints using live analysis and investigation fundamentals.

     

    Hands-on activities include writing TQL searches, creating rules, analyzing and validating alerts from Helix, Network Security, and Endpoint Security (HX), deep analysis of endpoint data collections, and response actions through Endpoint Security (HX) such as collecting data from across the enterprise and containing endpoints.

    • Identify the components needed to deploy Trellix Helix, Network Security, and Endpoint Security (HX)
    • Determine which data sources are most useful for Helix detection and investigation
    • Locate and use critical information in a Helix alert to assess a potential threat
    • Comfortably pivot from the Helix web console to native Trellix tools for deep analysis
    • Validate Network Security and Endpoint Security (HX) alerts
    • Use specialized features of Network Security and Endpoint Security (HX) to investigate and respond to potential threats across enterprise systems and endpoints

    Day 1

    Helix Fundamentals

    • Helix Overview
    • Features and Capabilities
    • Searching and Pivoting
    • 3rd Party Data Sources
    • Custom Dashboards

    Data Sources

    • Cloud Data Sources
    • On-premises Data Sources
    • Data Access

    Custom Dashboards, Reports, and Lists

    • Custom Dashboards
    • Reports
    • Lists

    Search and Trellix Query

    • Language (TQL)
    • Searchable Fields
    • Anatomy of an MQL Search
    • MQL Search, Directive, and Transform Clauses

    Day 2

    Rules

    • Creating and Enabling Rules
    • Using Regular Expressions in Rules
    • Helix Analytics
    • Multi-stage Rules

    Initial Alerts

    • Helix Alerts
    • Guided Investigations
    • Endpoint Security (HX) Alerts
    • Network Security Alerts

    Helix Case Management

    • Creating a Case in Helix
    • Adding Events to a Case
    • Case Workflow

    Day 3

    Data Sources, Trends, and the Attack Lifecycle

    • Threat Landscape
    • Attack Motivations
    • MITRE ATT&CK Framework
    • Emerging Threat Actors

    Using Audit Viewer and Redline®

    • Access Triage and Data Collections for Hosts
    • Navigate a Triage Collection or Acquisition using Audit Viewer
    • Apply Tags and Comments to a Triage Collection to Identify Key Events

    Windows Telemetry and Acquisitions

    • Live Forensic Overview
    • Windows Telemetry
      • Memory Artifacts
      • System Information
      • Processes
      • File System
      • Configuration Files
      • Services
      • Scheduled Tasks
      • Logging
    • Acquiring Data

    Day 4

    Investigation Methodology

    • MITRE ATT&CK Framework
    • Mapping Evidence to Attacker Activity
      • Evidence of Initial Compromise
      • Evidence of Persistence
      • Evidence of Lateral Movement
      • Evidence of Internal Reconnaissance
      • Evidence of Data Exfiltration

    Capstone: Capture the Flag (CTF)

    Security analysts, incident responders, and threat hunters who use Helix, Network Security and Endpoint Security (HX) to detect, investigate, and prevent cyber threats.

    Students taking this course should have a working understanding of networking and network security, the Windows operating system, file system, registry, and use of the command line interface (CLI).

      Datoer
      Date on Request

    Follow Up Courses

    Filtrer
    • 1 Dag
      Date on Request
      Price on Request
      Book Now
    • 4 Dager
      Date on Request
      Price on Request
      Book Now

    Know someone who´d be interested in this course?
    Let them know...

    Use the hashtag #InsoftLearning to talk about this course and find students like you on social media.