VMware Carbon Black EDR Advanced Analyst

Target group

System administrators and security operations personnel, including analysts and managers

Course structure

Course Introduction

• Introductions and course logistics
• Course objectives

VMware Carbon Black EDR & Incident Response

• Framework identification and process

Preparation

• Implement the Carbon Black EDR instance according to organizational requirements

Identification

• Use initial detection mechanisms
• Process alerts
• Proactive threat hunting
• Incident determination

Containment

• Incident scoping
• Artifact collection
• Investigation

Eradication

• Hash banning
• Removing artifacts
• Continuous monitoring

Recovery

• Rebuilding endpoints
• Getting to a more secure state

Lessons Learned

• Tuning Carbon Black EDR
• Incident close out