Duration

1 days.

Prerequisites

This course requires completion of the following course:

  • VMware Carbon Black App Control Administrator

Skills Gained

By the end of the course, you should be able to meet the following objectives:

  • Manage and configure the Carbon Black App Control sever based on organizational requirements
  • Implement rules to support business processes and automatic approvals
  • Identify scenarios and use cases for Custom rules and Event rules
  • Describe common troubleshooting scenarios for the Carbon Black App Control server
  • Describe common troubleshooting scenarios for the Carbon Black App Control Windows agent

Who Can Benefit?

System administrators and security operations personnel, including analysts and managers

    Outline for VMware Carbon Black App Control Advanced Administrator Training

    Outline

    Course Introduction

    • Introductions and course logistics
    • Course objectives

    Custom Rules Basics

    • Execute / Write action rules
    • Precedence
    • Paths

    Custom Rules Best Practices

    • Rule Triad
    • Rule multiplication

    Rule Types

    • Custom rule type overview

    Optimizing Custom Rules

    • Evaluating events

    Event Rules

    • Creating and editing
    • Testing before implementing

    Troubleshooting Considerations

    • Server versus agent issues

    Server Capabilities

    • Tools, logs, common issues, scenarios

    Agent Capabilities

    • Tools, logs, common issues, scenarios

    Product Alignment

    • Mware Carbon Black App Control