EDR Advanced Analyst

Session Detail:    Classroom 1 Day

This one-day course teaches you how to use the VMware Carbon Black® EDR™ product during incident response. Using the SANS PICERL framework, you will configure the server and perform an investigation on a possible incident. This course provides guidance on using Carbon Black EDR capabilities throughout an incident with an in-depth, hands-on, scenario-based lab.


This course requires completion of the following course:

  • VMware Carbon Black EDR Administrator

Who Can Benefit

Security operations personnel, including analysts and incident responders.

Session Outline

Class Outline

Module 1: Course Introduction

  • Lesson 1: Introductions and course logistics
  • Lesson 2: Course objectives

Module 2: VMware Carbon Black EDR & Incident Response

  • Lesson 1: Framework identification and process

Module 3: Preparation

  • Lesson 1: Implement the Carbon Black EDR instance according to organizational requirements

Module 4: Identification

  • Lesson 1: Use initial detection mechanisms
  • Lesson 2: Process alerts
  • Lesson 3: Proactive threat hunting
  • Lesson 4: Incident determination

Module 5: Containment

  • Lesson 1: Incident scoping
  • Lesson 2: Artifact collection
  • Lesson 3: Investigation

Module 6: Eradication

  • Lesson 1: Hash banning
  • Lesson 2: Removing artifacts
  • Lesson 3: Continuous monitoring

Module 7: Recovery

  • Lesson 1: Rebuilding endpoints
  • Lesson 2: Getting to a more secure state

Module 8: Lessons Learned

  • Lesson 1: Tuning Carbon Black EDR
  • Lesson 2: Incident close out

Need to train your team?

All of our sessions can be customized to meet your team’s specific need. Build the perfect program by picking and choosing topics from any of the courses in our catalog. A personalized private session gives you the ultimate flexibility and helps maximize your team’s valuable time!

Requesting Team Training
DateTimeTypePriceAdd To Cart

EDR Advanced Analyst

1 Day


Chat with a Coach

Chat with a Coach

Have a more immediate need? Why spend the next hour searching online for answers when you can spend just 15 minutes with one of our experts and get accurate and personalized answers to all of your questions. 

$9.99 | 15 Minutes

Book Now