| Topic | Details |
| Topic 1 | - User Assessment: Examines user attributes, differences between users
- endpoints
- entities, risk baselining, risky account types, elevated privileges, watchlists, and honeytoken accounts.
|
| Topic 2 | - GraphQL API: Covers Identity API documentation, creating API keys, permission levels, pivoting from Threat Hunter to GraphQL, and building queries.
|
| Topic 3 | - Zero Trust Architecture: Covers NIST SP 800-207 framework, Zero Trust principles, Falcon's implementation, differences from traditional security models, use cases, and Zero Trust Assessment score calculation.
|
| Topic 4 | - Multifactor Authentication (MFA) and Identity-as-a-service (IDaaS) Configuration Basics: Focuses on accessing and configuring MFA and IDaaS connectors, configuration fields, and enabling third-party MFA integration.
|
| Topic 5 | - Risk Assessment: Covers entity risk categorization, risk and event analysis dashboards, filtering, user risk reduction, custom insights versus reports, and export scheduling.
|
| Topic 6 | - Identity Protection Tenets: Examines Falcon Identity Protection's architecture, domain traffic inspection, EDR complementation, human vulnerability protection, log-free detections, and identity-based attack mitigation.
|
| Topic 7 | - Falcon Fusion SOAR for Identity Protection: Explores SOAR workflow automation including triggers, conditions, actions, creating custom
- templated
- scheduled workflows, branching logic, and loops.
|
| Topic 8 | - Configuration and Connectors: Addresses domain controller monitoring, subnet management, risk settings, MFA and IDaaS connectors, authentication traffic inspection, and country-based lists.
|
| Topic 9 | - Threat Hunting and Investigation: Focuses on identity-based detections and incidents, investigation pivots, incident trees, detection evolution, filtering, managing exclusions and exceptions, and risk types.
|
| Topic 10 | - Risk Management with Policy Rules: Covers creating and managing policy rules and groups, triggers, conditions, enabling
- disabling rules, applying changes, and required Falcon roles.
|
| Topic 11 | - Domain Security Assessment: Focuses on domain risk scores, trends, matrices, severity
- likelihood
- consequence factors, risk prioritization, score reduction, and configuring security goals and scopes.
|