Descrizione
Introduction
Successful completion of this instructor-led course with hands-on lab activities should enhance the student’s understanding of how to activate a Cortex XDR instance; create agent installation packages to install the Cortex XDR agents; create security policies and profiles to protect endpoints against multi-stage, fileless attacks built using malware and exploits; respond to attacks using response actions;understand behavioral threat analysis, log stitching, agent-provided enhanced endpoint data, and causality analysis; investigate and triage attacks using the incident management page of Cortex XDR and analyze alerts using the Causality and timeline analysis views; use API to insert alerts; create BIOC rules; and search a lead in raw data sets in Cortex Data Lake using Cortex XDR Query Builder.
Target Audience Cybersecurity analysts and engineers, and security operations specialists
Prerequisites & Audience
Participants must be familiar with enterprise security concepts.
Course Topics
Course Modules
1. Cortex XDR Family Overview
2. Working with the Cortex Apps
3. Getting Started with Endpoint Protection
4. Malware Protection
5. Exploit Protection
6. Exceptions and Response Actions
7. Behavioral Threat Analysis
8. Cortex XDR Rules
9. Incident Management
10. Alert Analysis Views
11. Search and Investigate
12. Basic Troubleshooting
