25,000+ Courses Nationwide
0345 4506120

VMware Carbon Black EDR Advanced Analyst

This one-day course teaches you how to use the VMware Carbon Black® EDR™ product during incident response. Using the SANS PICERL framework, you will configure the server and perform an investigation on a possible incident. This course provides guidance on using Carbon Black EDR capabilities throughout an incident with an in-depth, hands-on, scenario-based lab.

Intended Audience

Security operations personnel, including analysts and incident responders

Product Alignment

  • VMware Carbon Black EDR


Select specific date to see price, venue and full details.

Learning Objectives

By the end of the course, you should be able to meet the following objectives:

  • Utilize Carbon Black EDR throughout an incident
  • Implement a baseline configuration for Carbon Black EDR
  • Determine if an alert is a true or false positive
  • Fully scope out an attack from moment of compromise
  • Describe Carbon Black EDR capabilities available to respond to an incident
  • Create addition detection controls to increase security



This course requires completion of the following course:

  • VMware Carbon Black EDR Administrator

Course Content

1 Course Introduction

  • Introductions and course logistics
  • Course objectives

2 VMware Carbon Black EDR & Incident Response

  • Framework identification and process

3 Preparation

  • Implement the Carbon Black EDR instance according to organizational requirements

4 Identification

  • Use initial detection mechanisms
  • Process alerts
  • Proactive threat hunting
  • Incident determination

5 Containment

  • Incident scoping
  • Artifact collection
  • Investigation

6 Eradication

  • Hash banning
  • Removing artifacts
  • Continuous monitoring

7 Recovery

  • Rebuilding endpoints
  • Getting to a more secure state

8 Lessons Learned

  • Tuning Carbon Black EDR
  • Incident close out

Exams & Certification

How to receive your Certificate of Attendance for a VMware course

VMware delegates create a VMware account on https://mylearn.vmware.com/ at the start of their course and once they complete it, a digital certificate is issued and available online in that portal.

Related Courses

Privacy Notice

In order to provide you with the service requested we will need to retain and use your contact information in accordance with our Privacy Notice. If you choose to provide us with this information you explicitly consent to us using the information as necessary to provide the requested service to you. If you do not agree please do not proceed to request the service from us.

Marketing Permissions

Would you like to receive our newsletter and other information on products and services which we think will be of interest to you by email. We will always treat your information with care and in accordance with our Privacy Notice. You are free to withdraw this permission at any time.


We work with the best