Endpoint Detection and Response with Forensics On-Prem Analyst

Course Length:

2 days

Overview:

This course equips Security Analysts and Incident Responders to detect, investigate, and remediate endpoint threats using Trellix EDR with Integrated Forensics On-Premises (EDRF On-Prem). Designed for air-gapped, high-security, or regulated environments, it covers a localized three-server topology: ePolicy Orchestrator (ePO) On-Premises, Forensics HX Controller, and EDRF Telemetry Store (OpenSearch cluster) connected via Data Exchange Layer (DXL).

Core topics include:

• Monitoring host alerts
• Threat hunting with Historical Search, Enterprise Search, Process and Logon Trackers
• Obtaining forensic acquisitions (File, Triage, Data)
• Auditing evidence via Audit Viewer
• Localized containment with remote shell remediation

This course also includes usage of the ETS Explorer and HX Tool.

Who Should Attend:

Security Analysts, Incident Responders, and Threat Hunters concerned with Endpoint Security and Forensic investigation.

Download PDF Course Data Sheet