Call : (+91) 968636 4243
Mail : info@EncartaLabs.com
EncartaLabs

SentinelOne IR Threat Hunting

( Duration: 1 Day )

This SentinelOne IR Threat Hunting training course provides skills on the Threat Hunting and IR techniques.

By attending SentinelOne IR Threat Hunting workshop, delegates will learn:

  • EC Council’s 17 phases
  • Threat Hunting and IR techniques
  • Blue Team
  • Red Team
  • DFIR
  • ATT&CK MITRE
  • Remote Shell
  • Firewall Orchestration
  • Group policies
  • API

  • Understanding of networking and network security
  • Understanding of fundamental information security concepts
  • Be familiar with the Microsoft Windows environment

The SentinelOne IR Threat Hunting class is ideal for:

  • Security Analysts
  • SecOps
  • System Ops
  • Security Architects

COURSE AGENDA

1

Introduction

  • What is SentinelOne
2

Mindset of a Threat Hunter

  • EC Council’s 17 Phases
  • What is Threat Hunting
  • What a Blue Team does and which skills to take away from Blue Team experience
  • What a Red Team does and which skills to take away from Red Team experience
  • Intel
    • Intel the process
    • Intel the product
    • ATT&CK MITRE
    • Common Vocabulary
    • Behaviors > Indicators
  • Paranoia
    • The cycle of thought that drives threat hunting
3

Hunting, Not Searching

  • Difference between searching and hunting
  • Knowing when searching is OK
  • Building better hunts
  • Postulating
  • Creating and testing an attack hypothesis
  • IOCs, TTPs and Storyline
4

Advanced IR

  • Techniques
    • S1QL
    • Watchlists/WAR
    • Hunter Extension
    • Hermes
    • SIEM/SOAR
  • Remote Shell
    • Scripting and Remote Execution
    • Architecture
    • Execution
  • Reporting
5

Threat Hunting with SentinelOne

  • Containment and Acquisition
    • Network Quarantine
    • File Fetch
  • Alerts
    • Incident Threats Page
    • Notes
    • MITRE Mapping
  • Deep Visibility
    • Storyline
    • 30 days of Event Data
  • Remote Shell
    • Using other Forensic Kits (Scripts)
    • Issuing WMI Commands
  • "Mark as Threat" Workflow
  • Rollback
  • Remediation
  • Device Control
  • Firewall Orchestration
  • Group Policies
  • API

Encarta Labs Advantage

  • One Stop Corporate Training Solution Providers for over 6,000 various courses on a variety of subjects
  • All courses are delivered by Industry Veterans
  • Get jumpstarted from newbie to production ready in a matter of few days
  • Trained more than 50,000 Corporate executives across the Globe
  • All our trainings are conducted in workshop mode with more focus on hands-on sessions

View our other course offerings by visiting https://www.encartalabs.com/course-catalogue-all.php

Contact us for delivering this course as a public/open-house workshop/online training for a group of 10+ candidates.

Top
Notice
X