Course Description

This hands-on course involves practical exercises and real-life simulations in the use of OpenText™ Endpoint Forensics & Response to empower SOCs with near real-time threat containment and deep forensic visibility. Investigate attacks, isolate endpoints, and remediate threats fast, reducing dwell time, preserving evidence, and improving cyber resilience.

Delivery method: Classroom. NASBA defined level: basic.

CPE Credits - 32

Students attending this course will learn the following:

• How to install and configure the Secure Authentication of EnCase (SAFE) server software.
• How to deploy the agent, which enables the examination of network nodes remotely.
• How to preview and acquire remote data, both at a physical (sector-by-sector) level and logically.
• How to preview and acquire physical memory (RAM) and capture a snapshot of volatile data, including open ports and running processes.
• How to preview and collect data using the Rapid Preview OpenText Endpoint Investigator functionality.
• How to collect data by using the Enhanced Agent.
• How to navigate, filter, sort, and search data shown in the OpenText Endpoint Investigator interface.
• How to use the Evidence Processor to identify email and internet artifacts.
• How to bookmark notable data and build a case report.

Course Syllabus

Prerequisites

Basic computer skills. Advance preparation for this course is not required.