| Thema | Einzelheiten |
| Thema 1 | - Configuration and Connectors: Addresses domain controller monitoring, subnet management, risk settings, MFA and IDaaS connectors, authentication traffic inspection, and country-based lists.
|
| Thema 2 | - User Assessment: Examines user attributes, differences between users
- endpoints
- entities, risk baselining, risky account types, elevated privileges, watchlists, and honeytoken accounts.
|
| Thema 3 | - Falcon Identity Protection Fundamentals: Introduces the four menu categories (monitor, enforce, explore, configure), subscription differences between ITD and ITP, user roles, permissions, and threat mitigation capabilities.
|
| Thema 4 | - Falcon Fusion SOAR for Identity Protection: Explores SOAR workflow automation including triggers, conditions, actions, creating custom
- templated
- scheduled workflows, branching logic, and loops.
|
| Thema 5 | - Threat Hunting and Investigation: Focuses on identity-based detections and incidents, investigation pivots, incident trees, detection evolution, filtering, managing exclusions and exceptions, and risk types.
|
| Thema 6 | - Multifactor Authentication (MFA) and Identity-as-a-service (IDaaS) Configuration Basics: Focuses on accessing and configuring MFA and IDaaS connectors, configuration fields, and enabling third-party MFA integration.
|
| Thema 7 | - Zero Trust Architecture: Covers NIST SP 800-207 framework, Zero Trust principles, Falcon's implementation, differences from traditional security models, use cases, and Zero Trust Assessment score calculation.
|
| Thema 8 | - GraphQL API: Covers Identity API documentation, creating API keys, permission levels, pivoting from Threat Hunter to GraphQL, and building queries.
|
| Thema 9 | - Domain Security Assessment: Focuses on domain risk scores, trends, matrices, severity
- likelihood
- consequence factors, risk prioritization, score reduction, and configuring security goals and scopes.
|
| Thema 10 | - Risk Assessment: Covers entity risk categorization, risk and event analysis dashboards, filtering, user risk reduction, custom insights versus reports, and export scheduling.
|