Mcafee Mvision EDR

Endpoint detection and response (EDR) continuously monitor and gather data to provide the visibility and context needed to detect and respond to threats. But current approaches often burden already-stretched security teams with too much information. McAfee® MVISION EDR helps to manage the high volume of alerts, empowering analysts of all skill levels to do more and investigate more effectively. This course prepares security operations center (SOC) analysts to understand, communicate, and use the features of McAfee MVISION EDR. Through handson lab exercises, you will learn how to detect advanced device threats, fully investigate, and respond quickly.

Course modules:

• Install MVISION EDR on an on-premises
• Deploying extensions
• Initial configuration
• Deploy the MVISION EDR Client to endpoints
• View threat events in the Monitoring dashboard
• Review the MVISION EDR threat detection approach
• Take action from the Monitoring dashboard
• Leverage the Alerting dashboard to view the raw events from managed devices
• View how alert events match to the MITRE observed tactics and techniques
• Use historical data to assist with analyzing how a threat occurred in the system and what triggered it
• Review the Historical Search investigation capabilities
• Obtain information about processes currently running on managed endpoints using real-time search queries
• Leverage the query syntax to combine collectors and build powerful search expressions
• Take action on search results to execute reaction code onto managed endpoints
• Analyze an investigation using the key findings and key artifacts discovered
• View details to investigated items, linked investigations, investigation guides, and similar cases in the investigation workspace
• Navigate to the Catalog dashboard to view built-in collectors and reactions
• Use the Catalog dashboard to create or delete custom collectors and reactions
• View the details of actions performed through the Action History dashboard
• View the Performance Metrics page to analyze the amount of time spent on resolving investigations
• Walk through actions to take if no events are seen in the Monitoring dashboard
• View MVISION EDR tenancy status
• Perform troubleshooting steps for Investigations
• Troubleshoot Data Exchange Layer (DXL) connectivity
• Use the Monitoring dashboard to identify threats
• Create an investigation
• Quarantine a system or process
• Perform in-depth analysis using real-time search
• Increase familiarity and workflow with MVISION EDR