Sam, an EDR analyst at Harbor Freight, runs the eight-layer endpoint defense stack an intrusion must pass: prevent, telemetry, detect, triage, investigate, contain, remediate and hunt. A process tree shows a phishing document in Word spawning encoded PowerShell and then a credential-dumping tool on a finance PC; containment isolates the host with memory kept, disables the stolen account and blocks command-and-control for the segment; remediation quarantines the file, removes both the Run key and the scheduled task, and closes the way in.

CY-MID-023Mid Level · Endpoint Security

Endpoint Detection & Response Operations — The Endpoint Defense Stack

A hands-on mid-level course that operates an EDR/XDR platform across a fleet of endpoints. Work the endpoint defense stack - eight layers from Prevention and Telemetry through Detection, Triage, Investigation, Containment, and Remediation to Threat Hunting - reading sensor telemetry, writing ATT&CK-mapped detections, isolating hosts, and hunting proactively. Strictly defensive: you operate on endpoints you manage. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Read endpoint telemetry and map behaviour to MITRE ATT&CK techniques.
Write and tune behavioural detections that fire on the true positive.
Triage, investigate, and reconstruct an attack from process and network events.
Contain, remediate, and hunt proactively from threat-informed hypotheses.

Price:৳8,000