| ❗ This Course is currently undergoing some updates, appreciate your patience as we are working on bringing for you the best training experience. |
Access Training
for Customers/Partners
for NetWitness Employees
Check out the newly released 11.6 ILT class here
Summary
Interested in hunting? Don’t know where to start? This course is a great place to begin as we will give you a recommended approach for identifying threats using the NetWitness Platform.
Overview
This classroom training provides an overview of threat hunting and covers hunting tools, content and methodologies that can be used to proactively find suspicious behavior. Students will apply the techniques acquired in this course to identify anomalies and find threats in the environment using Packets, Logs and Endpoint.
Audience
Anyone interested in hunting with the NetWitness Platform
Duration
2 days
Prerequisite Knowledge/Skills
Students should have the following skills or taken the following training (or have equivalent knowledge) prior to attending this course:
• Introduction to the NetWitness Platform
• NetWitness Platform Foundations
• NetWitness Platform Analysis
Course Objectives
Upon successful completion of this course, participants should be able to:
• Describe threat hunting and incident response roles.
• Describe the NetWitness Hunting Guide.
• Describe the hunting methodology.
• Describe the Hunting Pack meta .
• Describe the UEBA Essentials Content Pack.
• Describe the UEBA Essentials Hunting Guide.
• Describe the MITRE’s ATT&CK™ frameworks.
• Describe NetWitness Hunting Cards.
• Describe the basics of hunting with NetWitness Endpoint.
• Describe NetWitness Platform hunting tools.
• Identify protocol/service anomalies.
• Identify indicators of malicious traffic.
• Use hunting techniques, methodology and tools to detect threats.
• Respond to incidents.
• Report findings.
Course Outline
- Threat hunting
- NetWitness Hunting Guide and Hunting Pack
- Hunting Methodology
- NetWitness UEBA Essentials Contnet Pack
- NetWitness Hunt Cards
- Hunting with NetWitness Endpoint
- Identifying protocol anomalies
- Indicators of Compromise
- Attack characteristics
- Creating a security incident report
- Hunting for threats
If you have any questions, please contact your account manager or Contact Us directly!
