Summary
This course presents a recommended process for responding to incidents using NetWitness Platform analysis tools and techniques. Students practice the techniques and process by working through a series of use cases.
Audience
Level 1 and Level 2 analysts relatively new to NetWitness Platform, who wish to increase their familiarity with the tool’s features and functions within the context of incident response and analysis.
Duration 2 days
Prerequisites Knowledge/Skills
NetWitness Platform Foundations
Students should have familiarity with the basic processes of cybersecurity analysis, including some knowledge of network architecture, the TCP/IP stack, networking protocols, and integrating log & network traffic to perform analysis on network-based security events.
$2,310 USD ⁓ 2,000 Training Credits
Delivery Types:
This course is delivered in 2 Modalities:
- Virtual - Instructor Led Training (VILT) v12.4
- On-Demand Classroom (ODC) v11.6
Course Overview:
This course covers how to use the NetWitness platform including logs, packets and Advanced Endpoint, to respond to incidents by investigating incidents in the queue, documenting incidents, and escalating or closing incidents.
Students will use NetWitness Platform Investigation features to analyze incidents using a recommended process.
NetWitness Platform Analysis version 12.4
Access Training
for Customers/Partners
Access Training
for NetWitness Employees
Course Objective
- Identify Analyst roles and SOC models
- Describe incident types and methods to prioritize incidents
- Describe the Incident Response process
- Use tools and methods to filter data and enhance the dataset
- Use analysis tools and interfaces to perform incident response
- Describe the Investigative Methodology
- Describe a systematic approach to investigate metadata
- Identify types of threats
- Use the incident response process, the investigative methodology and tools to investigate multiple use cases using packets, logs and endpoint.
Version Highlights:
- Introducing the Centralized Content Management (CCM) feature and how to use it to control your content.
- Explaining the Endpoint 12.x updates, such as the new tree view of incidents, Endpoint detections using imported file hashes, and Yara Scan.
- Clarifying the new incident workflow to streamline the process of assigning and investigating incidents.
- Extending the Analyst interaction with incidents in Respond by being able to export incident data, which includes original or normalized alerts, and exploring incidents history and metrics.
- Introducing new meta interaction in the Hosts and Files views.
- Enhancing the Investigate UI, such as the creation of custom Springboards and the NOT Contains operator.
Course Outline
Module 1: Analysis Tools and Processes
Module 2: Investigating Metadata
Module 3: Analysis Use Cases
NetWitness Platform Analysis version 11.6
Access Training
for Customers/PartnersAccess Training
for NetWitness Employees
If you have any questions, please contact your account manager or Contact Us directly!
Additional resources
If you have any questions, please contact your account manager or Contact Us directly!
