VMware Carbon Black Cloud Audit and Remediation

This one-day course teaches you how to use the VMware Carbon Black® Cloud Audit and Remediation™ product to build queries for IT hygiene, incident response, and vulnerability assessment to support your organization’s security posture and policies. This course provides an in-depth, technical understanding of the product through comprehensive coursework and hands-on scenario-based labs.

Upon completing this course, the student will be able to meet these objectives:

• Describe the components and capabilities of VMware Carbon Black Cloud Audit and Remediation
• Identify the architecture and data flows for Carbon Black Cloud Audit and Remediation communication
• Describe the use case and functionality of recommended queries
• Achieve a basic knowledge of SQL
• Describe the elements of a SQL query
• Evaluate the filtering options for queries
• Perform basic SQL queries on endpoints
• Describe the different response capabilities available from VMware Carbon Black Cloud

The primary audience for this course is as follows:

• Systems Administrators
• Security Operations Personnel including analysts and managers

Completion of one of the following courses:

• VMware Carbon Black Cloud Fundamentals

Module 1: Course Introduction

• Introductions and course logistics
• Course objectives
• Describe the content of this course
• Gain a complete picture of the VMware certification system
• Familiarize yourself with the benefits of the VMware Education Learning Zone
• Identify additional resources

Module 2: Data Flows and Communication

• Hardware and software requirements
• Architecture
• Data flows

Module 3: Query Basics

• osquery
• Available tables
• Query scope
• Running versus scheduling

Module 4: Recommended Queries

• Use cases
• Inspecting the SQL query

Module 5: SQL Basics

• Components
• Tables
• Select statements
• Where clause
• Creating basic queries

Module 6: Filtering Results

• Where clause
• Exporting and filtering

Module 7: Basic SQL Queries

• Query creation
• Running queries
• Viewing results

Module 8: Advanced Search Capabilities

• Advanced SQL options
• Threat hunting

Module 9: Response Capabilities

• Using live response