LevelBlue Learning

The USM Anywhere™: Security Analysis (ANYSA) course provides security analysts with the knowledge and tools to fully leverage USM Anywhere to perform analyst duties. Students benefit from instructor lectures, and product demonstration. This comprehensive course ensures that you can use all of USM Anywhere’s functions and features to detect and respond to security incidents and determine the extent of a compromise.

Audience: Security analysts and IT professionals who work with USM Anywhere

Modules

• Introduction
• Preparation
• Tuning
• Threat Intelligence
• Detection & Evaluation
• Containment & Response
• Recovery
• Root Cause Analysis
• Useful Links
• Conclusion

Course Duration: 4 hours

This course will ​provide you with some key information to be aware of before setting up USM Anywhere and provide details about sensor deployment.

Audience: System administrators preparing to deploy USM Anywhere

Recommended Prerequisites: Introduction to USM Anywhere

Topics:

• Sensor Overview
• Preinstall Checklist
• Common Sensor Functionality
• VMware Sensor
• Microsoft Hyper-V Sensor
• Amazon Web Services Sensor
• Microsoft Azure Sensor
• Initial Deployment Workflow
• Sensor Setup Wizard
• Connecting Additional Sensors

Course Duration: 35 Minutes

This course demonstrates the initial deployment and configuration of a GCP sensor. It also demonstrates the sensor activation through the web UI.

Audience: USM Anywhere System Administrators

Course Duration: 7 Minutes

This course demonstrates the initial deployment and configuration of a Azure sensor. It also demonstrates the sensor activation through the web UI.

Audience: USM Anywhere System Administrators

Course Duration: 9 Minutes

This course demonstrates the initial deployment and configuration of a VMware sensor. It also demonstrates the sensor activation through the web UI.

Audience: USM Anywhere System Administrators

Course Duration: 5 Minutes

This course will teach you about rules in USM Anywhere​ and how they can be created in line with best practice so that they perform as efficiently as possible and avoid errors.

After completing this course, students will understand how rules are structured and the best practice you should follow when creating rules. You will also understand how to review rule history, statistics, and errors and how to address issues seen there in. 

Audience: USM Anywhere System Administrators

Recommended Prerequisites: USM Anywhere™: Deploy, Configure, Manage (ANYDC)

Topics

• Module 1: Operators Overview
• Module 2: Rules Best Practice
• Module 3: USM Anywhere Rules Status and Performance

Course Duration: 45 Minutes

This course demonstrates how to configure your Azure environment to collect and forward logs to a USM Anywhere sensor using the Azure Agent and Web Application logging.

Audience: USM Anywhere System Administrators

Recommended Prerequisites:

• Course: Introduction to USM Anywhere
• Course: Setting up USM Anywhere

Topics

• Module 1: Configuring Azure Sensor Credentials
• Module 2: Configuring Azure Agent Logging (Windows)
• Module 3: Configuring Azure Web App Logging

Course Duration: 32 minutes

This course introduces you to the AlienVault Agent. The AlienVault Agent extends the Endpoint Threat Detection and Response (EDR) capabilities of AlienVault® USM Anywhere™. It includes host-based threat detection, file integrity monitoring, Windows log collection and response actions, all without a sensor. Each agent will talk directly to AlienVault® USM Anywhere™. This makes the agent particularly useful for monitoring remote assets.

Audience: USM Anywhere System Administrators

Recommended Prerequisites:

• Course: Introduction to USM Anywhere
• Course: Setting up USM Anywhere

Course Duration: 15 Minutes

This course demonstrates how to configure your Microsoft HyperV server to forward both physical and virtual network traffic to your HyperV Sensor for monitoring​​.

Audience: USM Anywhere System Administrators

Course Duration: 4 Minutes

Tenable Nessus is the authenticated vulnerability scanner used by USM Anywhere. This quick-start guide shows how to quickly deploy a tenable scanner to perform scans of your assets.

Audience: IT professionals who will be installing, configuring, and using USM Anywhere

• Configure and Enable Tenable
• View Cloud Scanners
• Deploy a Local Scanner
• Download Vulnerability Plugins
• Choose a Default Scanner
• Launch a Vulnerability Scan from USM Anywhere

​This should take approximately 5 minutes to complete.​

This course introduces you to Sensor Apps and BlueApps in USM Anywhere. We define the differences between the two app types, showing the actions that can be leveraged and how these actions can be invoked through use cases for each type. Finally, we provide a demonstration of the Sensor Apps and BlueApps UI.

Audience: USM Anywhere System Administrators

Recommended Prerequisites:

• Course: Introduction to USM Anywhere
• Course: Setting up USM Anywhere

Course Duration: 27 Minutes

This course demonstrates how to configure Multi-Factor Authentication for USM Anywhere user accounts.

Audience: USM Anywhere System Administrators

Recommended Prerequisites:

• Course: Introduction to USM Anywhere
• Course: Setting up USM Anywhere

Course Duration: 5 Minutes

This course introduces the SentinelOne® Management Console to students and shows all the functionality available to detect and protect against attacks on endpoints where the SentinelOne® Agent is installed.

Audience

• Endpoint Security with SentinelOne® Customers
• SentinelOne® Customers

Modules

• Introduction and Course Overview
• Technology Overview
• SentinelOne Agent
• Threat Detection
• Tuning
• API Integration
• Conclusion

Course Duration: 145 minutes

This course will be updated regularly with threat Intelligence news and noteworthy items to help prevent and fight cybersecurity threats targeting your  organization.

Audience: This material is targeted at cybersecurity professionals and IT professionals who wish to keep current on all the latest threats.

Are you just starting out with IT Security, trying to become familiar with some of the core terms? Well if the concepts and terminology surrounding security are “alien” to you this course may help provide some of the information you need.

This material is not a replacement for a full Information Security course and is provided as a value add to students that have an IT background but may not be familiar with IT Security.

Audience: Everyone

Topics:

• Look at the reasons attackers attempt to exploit networks and systems.
• Review some of the most common system vulnerabilities.
• Examine the methods by which attacks are delivered.
• Consider attack types and how they are implemented at a high level.

Course Duration: 65 Minutes

Audience: Anyone interested in how ransomware attacks occur in an organization

Topics

• How Threat Actors target organizations.
• How a foothold is gained and data is exfiltrated.
• Steps to follow in the event of a ransomware attack.
• How to be prepared for a ransomware attack.

Course Duration: 40 Minutes

This course describes how to search and filter for alarms, events and logs within the USM Appliance product. Students benefit from instructor lectures, and product demonstration.

This course covers Modules 6-8 of the live online version of AUSE.

Audience

• Security Engineers
• Security Analysts
• IT Professionals who implement, operate or support security systems
• Security professionals working at resellers or partners

Modules

• Alarms, Events, Directives and Logs
• Policies and Actions
• Writing Directives

Course Duration 3 hours 5 minutes

This course describes Open Threat Exchange (OTX) and how to perform security analysis within the USM Appliance product. Students benefit from instructor lectures, and product demonstration.

This course covers Modules 11-13 of the live online version of AUSE.

Audience

• Security Engineers
• Security Analysts
• IT Professionals who implement, operate or support security systems
• Security professionals working at resellers or partners

Modules

• Open Threat Exchange (OTX)
• Security Analysis
• Reports

Course Duration 33 minutes

This course reviews how to troubleshoot common configuration problems within the USM Appliance product. Students benefit from instructor lectures, and product demonstration.

This course covers Modules 18-19 of the live online version of AUSE.

Audience

• Security Engineers
• Security Analysts
• IT Professionals who implement, operate or support security systems
• Security professionals working at resellers or partners

Modules

Troubleshooting

Course Duration 21 minutes

This course gives an orientation to USM Central. It is designed to introduce you to the USM Central platform and show you how you can connect existing USM Anywhere and USM Appliance deployments. You will also see how USM Central collects and centralizes alarm details to deliver a consolidated view into threats that have been identified, so you can respond quickly and effectively.

​Audience:

• Managed Security Service Providers (MSSPs)
• Managed Service Providers (MSPs)
• Enterprise Customers

Modules:

• Module 1: Course Overview and Objectives
• Module 2: Introduction to USM Central
• Module 3: Adding USM Anywhere to USM Central
• Module 4: Adding USM Appliance to USM Central
• Module 5: Role-Based Access Controls
• Module 6: Orchestration Rules Management

Course Duration: 26 Minutes

CCIR - Cybereason Certified Incident Responder

Is an advanced course that enables SOC analysts from Level3 and dedicated IR responders to triage, investigate, and hunt using Primarily the Cybereason platform for IR-Express

CCTS - Cybereason Certified Technical Specialist

プリセールス担当者がサイバーリーズンテクノロジーのデモを独自に実施する方法を学び、営業担当者が販売機会を絞り込むのを支援できるようにする。

Cybereason Certified Threat Hunter Course (CCTH)

Cyber​​eason認定脅威ハンター（CCTH）コースは、レベル2～3のSOCアナリストがCyber​​easonプラットフォームを使用して脅威のトリアージ、調査、および脅威ハンティングを行えるようになるための上級コースです。CCTHプログラムを修了すると、顧客のSOC環境を直接、またはマネージドサービスを通じてサポートするスキルを習得できます。

CCTS - Cybereason Certified Technical Specialist

For pre-sales specialist to learn how to independently demo Cybereason Technology to assist your sellers to qualify sales opportunities

CCSS - Cybereason認定セールススペシャリスト

Cyber​​easonのビジネスチャンスを発掘し、適格性を判断する方法を学びましょう。

Cybereason Certified Threat Analyst course​​ (CCTA)

​​​​​This Certification is a great way for you to further establish your credentials in the information security industry, professionally develop your SOC team, and be acknowledged as having the skills needed to use Cybereason’s EDR solution to triage malicious operations.