Your Cart Is Empty
Home > > > Cisco XDR Security Operations
Cisco XDR Security Operations (XDROPS) is a 3-day training guiding you through the main aspects and challenges of traditional SOC.
Cisco XDR Security Operations (XDROPS) is a 3-day training guiding you through the main aspects and challenges of traditional SOC. You will learn the Cisco XDR security platform and how it can simplify security operations in today's hybrid, multi-vendor, multi-threat landscape. Overview of all the main integration possibilities and components, including APIs discovery, Endpoint and Network Telemetry and ITSM, SIEM systems, and Public Cloud. Through expert instruction and hands-on lab exercises, you will learn how to read the components and work with Incident Manager for effective threat prioritization, streamlined investigations, and evidence-backed recommendations. In this training, you will discover how to elevate productivity with automation capabilities and boost your security resources for optimal value. The course qualifies for 24 Cisco Continuing Education credits (CE) towards recertification.
Category
ID
Duration
Level
Price
14033
3 Day(s)
$000.00
Objectives
Upon completing this course, the learner will be able to meet these overall objectives: • Understand the architecture of Cisco Secure Client/XDR. • Understand the Identification, Containment, Eradication, and Recovery Workflows. • Understand the XDR Remote Connector and how to accomplish arbitrary integrations. • Learn how to create automation using Automation APIs. • Recognize the types and sequence of Orchestration Workflows. • Understand the fundamentals of working with Public Cloud through XDR Orchestration. • Explain how to initiate Cisco XDR investigations from Splunk.
Module 1: Evolution and Introduction to Cisco XDR • Lesson 1: Detection and Response and the challenges of traditional SOC • Lesson 2: What is the OODA loop? • Lesson 3: Overview of Cisco XDR • High-level Architecture • Associating SOC profiles to XDR • Integrations and Response • XDR/EDR/MDR/SOAR/SIEM – Shared Use cases • Analytics and Correlation Engine Module 2: Threat Detection and Incident Response Workflow • Lesson 1: Understanding Threat Detections with Diverse Intelligence • Lesson 2: How to read components: Judgement / Indicators / Feeds / Events • Lesson 3: Cisco XDR: Incident Manager • Threat inspection captured Incidents • Infrastructure-based Incident Prioritization: Detection Risk and Asset Value • MITRE • Correlated pictorial representation of the threat summary • Severity Management based on Event types • Identification/Containment/Eradication and Recovery Workflows Module 3: Enrichment from Third-Party Integrations • Lesson 1: Overview of the third-party security landscape • Lesson 2: Built-in Integrations • EDR: Crowdstrike, Sentinel One, MSFT Defender, and more... • NDR: Dark Trace, Extrahop, and more... • Lesson 3: What is a Relay Module? • Lesson 4: XDR: Remote Connector • Lesson 5: Accomplishing arbitrary integrations Module 4: XDR APIs • Lesson 1: Northbound and Southbound APIs • Lesson 2: Threat Intelligence APIs: Private and public databases of threat intel • Lesson 3: Investigation APIs: Enrich data using your integrated products • Lesson 4: Response APIs • Lesson 5: OAuth APIs: Use credentials and get access tokens • Lesson 6: Automation APIs: Trigger workflows in XDR to do just about anything you want! Module 5: XDR Automation and Orchestration • Lesson 1: Understanding Orchestration Workflows: Types and sequence • Lesson 2: Workflows Components: Targets, Account Keys, Triggers, Variables, Events, Schedules & Reports • Lesson 3: Constructing a basic workflow • Lesson 4: Exploring built in cisco and third-party service activities and logics • Lesson 5: Customizing out of the box workflows to fit the business use case • Lesson 6: Nesting workflows • Lesson 7: Using Microsoft APIs to investigate/detect suspicious email with Cisco Secure Email • Lesson 8: Enforcing DLP policy on outgoing email using Cisco XDR automation Module 6: Endpoint and Network Telemetry • Lesson 1: Network and Endpoint Visibility Together: Telemetry + Device Insights • Lesson 2: Network Visibility Module • Lesson 3: Cisco Secure Client/XDR: Architecture • Lesson 4: Reports and Audit logs • Lesson 5: Asset Tag Device Management Module 7: Cisco XDR with ITSM, SIEM systems and Public Cloud • Lesson 1: Overview translation of Splunk CIM to XDR CTIM • Lesson 2: Initiating Cisco XDR investigation from Splunk • Lesson 3: Splunk and Cisco XDR Webhooks or Atomic Actions • Lesson 4: Overview of Cisco XDR and Service Now Integration • Lesson 5: Adding Context to ServiceNow incident – Using XDR Automate • Lesson 6: Fundamentals of working with Public Cloud with XDR Orchestration Lab Outline: Labs are designed to assure learners a whole practical experience, through the following practical activities: • Accessing Cisco XDR • Overview of Cisco XDR • Validate an Attack and Determine the Incident Response • Perform Threat Hunting • Discover Third Party integrations • Query and Recognize XDR API • Explore Cisco XDR Orchestration • Evaluate Assets in a Typical Enterprise Environment • Work with Endpoint and Network Telemetry • Explain how to initiate Cisco XDR investigations from Splunk • Explore the integration of Splunk and Cisco XDR through Webhooks or Atomic Actions
Questions?
The knowledge and skills that the learner should have before attending this course are as follows: • Working knowledge of the Windows and Linux operating systems. • Familiarity with basics of networking security concepts. • Technical understanding of TCP/IP networking and network architecture. • Technical understanding of security concepts and protocols. The recommended Cisco offering may help you meet these prerequisites: • Implementing and Administering Cisco Solutions (CCNA)
Cisco XDR Security Operations
Class Schedule
Course Overview
Training Delivery Methods
With Productivity Point, you will have a spectrum of delivery methods to choose from... when where and how you like it. Whether it's in a classroom or online, we have a delivery option to meets your needs.
Classroom Live
Classroom Virtual
Live Online
Private Group
On Demand
Classroom Live Training
Get in-person, hands-on instruction with live lab exercises taught by subject matter experts who deliver authorized and industry-leading content.
With classrooms in almost every major U.S. city, Productivity Point has something for users of every level, so you can earn the most popular industry certifications. You get hands-on learning experience with live lab exercises taught by experienced instructors. We proudly advocate our learning services to be hosted by the best-qualified trainers in terms of technical knowledge and teaching skills.
Classroom Virtual Training
Prefer to have a dedicated classroom for your virtual experience? Attend live, hands- on training via remote instructor from one of Productivity Point’s multiple locations.
Enjoy a focused and professional training environment, including all technical equipment provided along with administrative and technical support at your fingertips. With over 150 locations to choose from, review our course catalog or contact your personal Productivity Point Account Manager to see if the course you have in mind is delivered at one of our dedicated virtual classrooms in your area.
Live Online Training
Blend the best from traditional face-to-face instructor-led training with the latest in conferencing technology.
Private Group Training
Your private group classroom experience will not only take place in the location of your choice (including any of our training centers), but you will enjoy the following amenities:
On-Demand Learning
On-Demand is an IT training solution designed around your schedule, budget, and learning needs. Combining high-quality video, reading, and knowledge checks in a self-paced format, On-Demand helps you build skills as your schedule allows—all at once or five minutes at a time.
With On-Demand, you learn at your own pace and in the convenience of your own space.
With Learn at your own pace…
Productivity Point Learning Solutions evolved out of a desire to increase our outreach both nationally and internationally.
Productivity Point Headquarters 1580 Sawgrass Corporate Parkway Suite 205 Sunrise, Florida 33323 United States
Contact T 1-844-238-8607 P 1-954-425-6141 F 1-954-928-9057 E info@productivitypointls.com