VMware Carbon Black EDR Advanced Administrator Course Overview

To ensure that you can successfully participate in the VMware Carbon Black EDR Advanced Administrator course, the following minimum prerequisites are recommended:

• Basic understanding of endpoint security concepts
• Familiarity with VMware Carbon Black EDR or experience with other endpoint detection and response platforms
• Working knowledge of computer networks and security protocols
• Experience with Windows and Linux operating systems
• Basic understanding of system administration tasks and security operations
• Some exposure to database management and SQL queries could be beneficial
• Knowledge of programming or scripting basics, especially in Python, is advantageous but not mandatory
• An understanding of SIEM (Security Information and Event Management) systems can be helpful for integration modules

While these prerequisites are the minimum recommended, please keep in mind that the more experience you have in IT security and system administration, the more you may benefit from the advanced topics covered in this course.

Target Audience for VMware Carbon Black EDR Advanced Administrator

The VMware Carbon Black EDR Advanced Administrator course is designed for IT professionals seeking expertise in security operations and endpoint threat detection.

Target audience for the VMware Carbon Black EDR Advanced Administrator course includes:

• Security Operations Center (SOC) Analysts
• Incident Responders
• Endpoint Security Administrators
• Systems Administrators focusing on security
• Network Security Engineers
• IT Security Consultants
• VMware Carbon Black EDR Users
• Cybersecurity Professionals
• Threat Intelligence Analysts
• IT Professionals aiming for a career in cybersecurity
• Security Architects
• Security Systems Engineers

Learning Objectives - What you will Learn in this VMware Carbon Black EDR Advanced Administrator?

Introduction to Learning Outcomes:

The VMware Carbon Black EDR Advanced Administrator course equips learners with in-depth skills to manage, optimize, and troubleshoot the EDR environment effectively.

Learning Objectives and Outcomes:

• Understand the course structure, logistics, and key objectives for mastering VMware Carbon Black EDR.
• Comprehend the architecture of VMware Carbon Black EDR, including data flows, sizing, and communication channels.
• Gain knowledge of server datastores, focusing on the SOLR database, storage configurations, data aging, partition states, and Postgres.
• Learn the fundamentals of the Modulestore and its relevance in the EDR environment.
• Acquire skills to utilize the EDR API (CBAPI), enabling efficient access to data and integration with other systems.
• Develop the ability to view and interpret API calls directly from a web browser.
• Understand the structure and implementation of Threat Intelligence Feeds, including custom feed creation.
• Learn the configuration and integration of EDR with SIEM systems through Syslog for enhanced security information management.
• Master troubleshooting techniques for server-side issues, including the use of server-side scripts and understanding server logs.
• Understand sensor operations and troubleshooting, ensuring efficient endpoint communication and data collection.