Course Description

This hands-on course involves practical exercises and real-life simulations in the use of OpenText™ Endpoint Investigator and OpenText™ Endpoint Forensics & Response. The class provides participants with instruction on conducting previews, acquisitions, and searches, to name a few. The course concludes with instruction on using remediation functionality to stop unauthorized process from continuing to run.

Delivery method: Classroom. NASBA defined level: basic.

CPE Credits - 32

Students attending this course will learn the following:

OpenText Endpoint Investigator
• How to deploy the agent, which enables the examination of network nodes remotely.
• How to preview and acquire remote data, both at a physical (sector-by-sector) level and logically.
• How to preview and acquire physical memory (RAM) and capture a snapshot of volatile data, including open ports and running processes.
• Using rapid collection to acquire data.
• How to use the OpenText Endpoint Forensics & Response Snapshot function to acquire volatile data.
• How to preview and collect data using the rapid preview OpenText Endpoint Investigator functionality.
• Acquiring RAM.
• The importance of conducting both logical and physical acquisitions.
• Implementing the universal agent and Agent Management.
• How to create and implement raw keyword searches and index searches.
• How to collect data by using the universal agent.
• How to navigate, filter, sort, and search data shown in the OpenText Endpoint Investigator interface.
• How to use the Evidence Processor to identify email and Internet artifacts.
• How to bookmark notable data and build a case report.

OpenText Endpoint Forensics & Response
• How to manage user accounts.
• How to deploy the universal agent.
• How to manage groups and targets.
• How to create an investigation.
• How to navigate the web application.
• How to compare snapshots.
• How to use automated response.
• How to acquire RAM.
• How to create filters for data collection and/or indicators of compromise searches.
• How to use rapid preview and collect data.
• How to find items of interest.
• How to search for indicators of compromise (IOC).
• How to search and remediate from the Windows registry.
• How to isolate an endpoint.
• How to remediate processes.

Course Syllabus

Prerequisites

Basic computer skills. Advance preparation for this course is not required.