Rebuilding endpoint triage at Castellan Retail Group: a ransomware-precursor alert on a distribution-centre file server was rated medium and waited eleven hours in the queue; the triage method now runs evidence, scope, verdict and contain, with store containment rules owned by the Retail Operations Director after a 2025 isolation took tills down in 40 stores; sensor coverage and prevention mode rise across eight endpoint populations totalling 54,530 devices; and mean time to contain falls from 852 minutes to 54, inside the Board's 60-minute target.

CY-PRO-042Pro Level · Endpoint Security

EDR Alert Triage Operations

A forty-hour Pro-level endpoint detection and response triage simulation run on a live EDR triage command board, where you are Head of Endpoint Defence at a retailer with 640 stores and 54,530 endpoints; a ransomware-precursor alert waits eleven hours at ‘medium’ while a warehouse system is encrypted from a server nobody could see — and you measure the truth, close the blind spots, make the fleet prevent, rank the queue by what matters, contain without stopping trade, automate with brakes, hunt, prove quality and defend the capability to the Board.

40 hours12 chapters60 lessons433 activities12 labs

What you'll learn

Measure EDR honestly — healthy sensor coverage over the inventory, prevention share, alert priority and time to contain — and move an estate from watching to preventing without stopping the business.
Run evidence-led triage — priority by asset and stage, re-performable records, meaningful verdicts, scoping, escalation and four-eyes review — and contain with decision rights, guardrails, a ladder and rehearsed runbooks.
Extend the capability with automation that has brakes, hypothesis-led hunting, measured quality and a partner held to the organisation's own standard.
Price the capability at the margin, state residual risk against appetite, meet insurer, regulator and audit expectations with complete evidence, and win a resolution the Board can be held to.

Price:৳15,000