Access Training
for Customers/PartnersAccess Training
for NetWitness Employees
This is an Instructor Led Training class, for On-Demand/Self-Paced please click here
Summary
Interested in hunting? This course is a great place to begin as we will give you a recommended approach for identifying threats using the NetWitness Platform.
This is an update to version 11.6.
Overview
This course covers how to use the NetWitness 11.6 Platform including Logs, Packets and Advanced Endpoint, to find threats in the environment using a recommended methodology.
Audience
Anyone interested in hunting with the NetWitness Platform
Duration: 2 days
Prerequisite Knowledge/Skills
Introduction to the NetWitness Platform
NetWitness Platform Foundations
NetWitness Platform Analysis
Course Objectives
Upon completion of this training, the learner should be able to:
- Describe threat hunting and incident response roles
- Describe the Hunting Guide
- Describe the hunting methodology
- Describe the Hunting Pack meta
- Describe the UEBA Essentials Content Pack
- Describe the UEBA Essentials Hunting Guide
- Understand the MITRE’s ATT&CK ™ frameworks
- Describe NetWitness Hunting Cards
- Describe the basics of hunting with NetWitness Endpoint
- Describe NetWitness Platform hunting tools
- Identify protocol/service anomalies
- Identify indicators of malicious traffic
- Use hunting techniques, methodology and tools to detect threats
- Respond to incidents
- Report findings
Course Outline
Module 1: Hunting Techniques and Methodology
Module 2: Finding Anomalies
Module 3: Documenting Threats
