The RSA NetWitness Endpoint Foundations training course introduces security analysts and administrators to the architecture and toolkit for detecting and investigating risk on endpoint hosts. This course provides a general introduction to RSA NetWitness Endpoint analysis.
By attending RSA NetWitness Endpoint Foundations workshop, delegates will learn to:
- Describe what RSA NetWitness Endpoint is and what it does
- Identify architecture components
- Deploy a new endpoint agent
- Interpret risk scores and alerts based on endpoint data
- Explore metadata derived from endpoint scans
- Customize data types available in user interface
- Perform basic file and host analysis
- Obtain file and memory samples for forensic analysis
- Identify potentially malicious timestamp mismatches in MTF files
Basic knowledge of Malware, Networking Fundamentals and General Security Analysis Concepts is recommended.
This RSA NetWitness Endpoint Foundations class is intended forAnyone new to RSA NetWitness Endpoint interested in increasing their familiarity with the tool's features and functions within the context of endpoint investigation and analysis.