EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

FortiEDR

Course overview and objectives

2 days
Discuss this programme →

Duration

2 days

Course Description

In this two-day class, you will learn how to use FortiEDR to protect your endpoints against advanced attacks with real-time orchestrated incident response functionality.

Who Should Attend

IT and security professionals involved in the administration and support of FortiEDR should attend this course.

Agenda

  • Overview and Technical Positioning
  • Installation and Architecture
  • Administration
  • Best Practices and Deployment
  • The User Interface in Depth Part 1
  • The User Interface in Depth Part 2
  • Events and Alerting
  • Help Desk Level 1 Triage
  • Communication Control
  • Next-Generation Antivirus
  • Threat Hunting
  • RESTful API
  • Multi-Tenancy
  • Fortinet Cloud Services
  • Advanced Troubleshooting
  • Endpoint Security 101
  • PowerShell and CScript
  • Alert Analysis 401

Objectives

After completing this course, you should be able to:

  • Explain the FortiEDR approach and how it works
  • Identify the communicating components and how they are configured
  • Schedule, organize, and tune a new deployment
  • Carry out basic troubleshooting steps, including: verifying that FortiEDR is installed and actively blocking malware, identifying whether FortiEDR has blocked a process or connection, finding logs, and contacting FortiEDR Support
  • Perform important administrative tasks, including: managing console users, updating collectors, deleting personal data for GDPR compliance, and viewing system events
  • Complete basic tasks in of each area of the management console: the Dashboard, the Event Viewer, the Forensics tab, the Threat Hunting module, Communication Control, Security Policies, Playbooks, Inventory, and the Administration tab
  • Manage security events and their status
  • Block communication from applications that are risky or unwanted, but not inherently malicious
  • Define next-generation antivirus, its role in FortiEDR, and where it falls in the order of operations
  • Find and remove malicious executables from all the devices in your environment
  • Use RESTful API to manage your FortiEDR environment
  • Administer a multi-tenant environment
  • Recognize what Fortinet Cloud Service is and how it works
  • Troubleshoot collector upgrades and performance issues
  • Obtain collector logs and memory dumps
  • Have a basic understanding of the history of malware, how it exploits trust, and the persistence techniques used in malware today
  • Triage PowerShell and CScript events, verify their destinations, and retrieve memory
  • Prioritize, investigate, and analyze security events
  • Remediate malicious events and create exceptions to allow safe processes

System Requirements

If you take an online version of this class, you must have a computer with:

  • A high-speed Internet connection
  • An up-to-date web browser
  • A PDF viewer
  • Speakers / headphones
  • One of the following:
  • HTML5 support
  • An up-to-date Java Runtime Environment (JRE) with Java plugin enabled in your web browser

You should use a wired Ethernet connection, not a WiFi connection. Firewalls, including Windows Firewall or FortiClient, must allow connections to the online labs.

Programme scope, delivery arrangements and suitability are confirmed during enquiry.