Information Technology

VMware Carbon Black EDR: Install, Configure, Manage [V7.x]

Instructor-Led 13 Agenda

Description

This three-day, hands-on training course provides you with the knowledge, skills, and tools to achieve competency in installing, configuring, and managing the VMware Carbon Black® EDR™ environment. This course introduces you to product features, capabilities, and workflows for managing endpoint security. Hands-on labs enable learners to reinforce topics by performing operations and tasks within the product in a training environment.

Course Overview

Course Objective

By the end of the course, you should be able to meet the following objectives: Describe the architecture of a Carbon Black EDR implementation Perform the installation, upgrade, and configuration of the Carbon Black EDR server Describe the purpose and use of multiple datastores in the server Perform live queries across endpoints to gather additional data Perform effective searches across the dataset to find security artifacts related to the endpoints Manage Threat Intelligence Feeds and Watchlists Describe connectors in Carbon Black EDR Troubleshoot server and sensor problems Analyze data found in the Heads-Up Display Manage investigations to group and summarize security incidents and artifacts Perform the different response capabilities available to users in Carbon Black EDR Use the Carbon Black EDR API to automate tasks

Who Should Attend

Security analyst, threat hunters, or incident responders Security professionals who work with enterprise and endpoint security tools

Course Introduction Lesson Id 1

Course Introduction

Planning and Architecture Lesson Id 2

Planning and Architecture

Server Installation, Upgrade, and Administration Lesson Id 3

Server Installation, Upgrade, and Administration

Server Datastores Lesson Id 4

Server Datastores

Live Query Lesson Id 5

Live Query

Searching and Best Practices Lesson Id 6

Searching and Best Practices

Threat Intelligence Feeds and Watchlists Lesson Id 7

Threat Intelligence Feeds and Watchlists

Connectors in Carbon Black EDR Lesson Id 8

Connectors in Carbon Black EDR

Troubleshooting Lesson Id 9

Troubleshooting

Head-Up Display Lesson Id 10

Head-Up Display

Investigations Lesson Id 11

Investigations

Responding to Endpoint Incidents Lesson Id 12

Responding to Endpoint Incidents

Overview of Postman and the Carbon Black EDR API Lesson Id 13

Overview of Postman and the Carbon Black EDR API

Lesson Id	Title	Description
1	Course Introduction	Introductions and course logistics<br />Course objectives
2	Planning and Architecture	Describe the architecture and components of Carbon Black EDR<br />Identify the communication requirements for Carbon Black EDR
3	Server Installation, Upgrade, and Administration	Install the Carbon Black EDR server<br />Describe the options during the installation process<br />Install a Carbon Black EDR sensor<br />Confirm data ingestion in the Carbon Black EDR server<br />Identify built-in administration tools<br />Manage sensor groups<br />Manage users and teams
4	Server Datastores	Describe the datastores used in Carbon Black EDR<br />Interact with the available datastores
5	Live Query	Describe live query capabilities<br />Perform queries across endpoints
6	Searching and Best Practices	Describe the capabilities and data available in the process search<br />Perform process searches to find specific endpoint activity<br />Describe the capabilities and data available in the binary search<br />Perform binary searches to find application data<br />Describe the query syntax and advanced use cases<br />Perform advanced queries across the dataset
7	Threat Intelligence Feeds and Watchlists	Define Threat Intelligence Feeds<br />Manage the available Threat Intelligence Feeds<br />Describe the use of Watchlists<br />Manage Watchlists in the environment
8	Connectors in Carbon Black EDR	Configure connectors in Carbon Black EDR<br />Troubleshoot connectors
9	Troubleshooting	Identify the available troubleshooting scripts in the Carbon Black EDR server<br />Run troubleshooting scripts to identify problems<br />Generate a sensor log bundle<br />Identify the location of sensor registry keys
10	Head-Up Display	Identify panels relating to endpoint data<br />Analyze endpoint data provided by the panels<br />Identify panels relating to operations data<br />Analyze operations data provided by the panels<br />Identify panels relating to server data<br />Analyze server data provided by the panels<br />Define alert generation in Carbon Black EDR<br />Manage alerts
11	Investigations	Describe investigations<br />Explore data used in an investigation<br />Manage investigations<br />Manage investigation events
12	Responding to Endpoint Incidents	Describe isolation in Carbon Black EDR<br />Manage isolating endpoints<br />Describe live response capabilities<br />Manage live response sessions<br />Describe hash banning<br />Manage banned hashes
13	Overview of Postman and the Carbon Black EDR API	Explain the use of the API<br />Differentiate the APIs available for Carbon Black EDR<br />Explain the purpose of API tokens<br />Create an API token<br />Explain the API URL<br />Create a valid API request<br />Import a collection to Postman<br />Initiate an API request from Postman<br />Perform operations manually using Postman<br />Analyze the use cases for Postman<br />Show basic automation tasks using the API and curl<br />Compare the usage of curl with Postman