Carbonblack EDR

The VMware Carbon Black EDR Administrator lab is a comprehensive program designed to equip learners with the skills and knowledge needed to manage and administer VMware Carbon Black EDR (Endpoint Detection and Response) solutions effectively. This labcovers various aspects, from planning and architecture to threat intelligence and response strategies. Beginning with introductions and course logistics, the curriculum progresses through planning and hardware/software requirements, showcasing the architecture and data flows, and guiding students through server installation and sensor deployment. Learners will delve into server configuration, user management, and process analysis, enhancing their competence in searching for and analyzing processes, binaries, and implementing hash banning. Advanced modules offer insights into search best practices, threat intelligence integration, creating watchlists, and managing alerts and investigations. Practical skills such as network isolation and live response are also covered, preparing participants to promptly and efficiently handle security incidents. Overall, the VMware Carbon Black EDR Administrator course aims to develop proficiency in managing the EDR platform, ensuring learners are well-equipped to protect their organizations against cyber threats.

 

Course Modules:

1. Planning and Architecture

• Carbon black EDR Installation

• Installing sensors

2. Server Installation & Administration

• Configuration and settings

• Carbon Black EDR users and groups

3. Process Search and Analysis

• Filtering options

• Creating searches

• Process analysis and events

4. Binary Search and Banning Binaries

• Filtering options

• Creating searches

• Hash banning

5. Search best practices

• Search operators

• Advanced queries

6. Threat Intelligence

• Enabling alliance feeds

• Threat reports details

• Use and functionality

7. Watchlists

• Creating watchlists

• Use and functionality

8. Alerts / Investigations / Response

• Using the HUD

• Alerts workflow

• Using network isolation

• Using live response