2 Data Flows and Communication
• Hardware and software requirements
• Architecture
• Data flows
3 Searching Data
• Creating searches
• Analyzing events
• Search operators
• Advanced queries
4 Policy Components
• Rules
• Local scanner
• Sensor capabilities
5 Prevention Capabilities Using Rules
• Rule types
• Rule creation
• Reputation priority
• Configuring rules
• Evaluating rule impact
6 Processing Alerts
• Alert triage
• Alert actions
7 Response Capabilities
• Using quarantine
• Using live response
• Hash banning