IntroductionCourse Outline

Duration

30 days.

Prerequisites

This course requires completion of the following course:

  • VMware Carbon Black Cloud Fundamentals

Skills Gained

By the end of the course, you should be able to meet the following objectives:

  • Describe the components and capabilities of VMware Carbon Black Cloud Audit and Remediation
  • Identify the architecture and data flows for Carbon Black Cloud Audit and Remediation communication
  • Describe the use case and functionality of recommended queries
  • Achieve a basic knowledge of SQL
  • Describe the elements of a SQL query
  • Evaluate the filtering options for queries
  • Perform basic SQL queries on endpoints
  • Describe the different response capabilities available from VMware Carbon Black Cloud

Who Can Benefit?

System administrators and security operations personnel, including analysts and managers.

    Outline for VMware Carbon Black Cloud Audit and Remediation-On Demand Training

    Outline

    Course Introduction

    • Introductions and course logistics
    • Course objectives

    Data Flows and Communication

    • Hardware and software requirements
    • Architecture
    • Data flows

    Query Basics

    • osquery
    • Available tables
    • Query scope
    • Running versus scheduling

    Recommended Queries

    • Use cases
    • Inspecting the SQL query

    SQL Basics

    • Components
    • Tables
    • Select statements
    • Where clause
    • Creating basic queries

    Filtering Results

    • Where clause
    • Exporting and filtering

    Basic SQL Queries

    • Query creation
    • Running queries
    • Viewing results

    Advanced Search Capabilities

    • Advanced SQL options
    • Threat hunting

    Response Capabilities

    • Using live response

    Product Alignment

    • VMware Carbon Black Cloud Audit and Remediation
    • VMware Carbon Black Cloud Endpoint™ Advanced
    • VMware Carbon Black Cloud Endpoint™ Enterprise