| Topic | Details |
| Topic 1 | - Threat Hunting and Investigation: Focuses on identity-based detections and incidents, investigation pivots, incident trees, detection evolution, filtering, managing exclusions and exceptions, and risk types.
|
| Topic 2 | - User Assessment: Examines user attributes, differences between users
- endpoints
- entities, risk baselining, risky account types, elevated privileges, watchlists, and honeytoken accounts.
|
| Topic 3 | - Falcon Fusion SOAR for Identity Protection: Explores SOAR workflow automation including triggers, conditions, actions, creating custom
- templated
- scheduled workflows, branching logic, and loops.
|
| Topic 4 | - Risk Management with Policy Rules: Covers creating and managing policy rules and groups, triggers, conditions, enabling
- disabling rules, applying changes, and required Falcon roles.
|
| Topic 5 | - Domain Security Assessment: Focuses on domain risk scores, trends, matrices, severity
- likelihood
- consequence factors, risk prioritization, score reduction, and configuring security goals and scopes.
|
| Topic 6 | - Falcon Identity Protection Fundamentals: Introduces the four menu categories (monitor, enforce, explore, configure), subscription differences between ITD and ITP, user roles, permissions, and threat mitigation capabilities.
|
| Topic 7 | - Multifactor Authentication (MFA) and Identity-as-a-service (IDaaS) Configuration Basics: Focuses on accessing and configuring MFA and IDaaS connectors, configuration fields, and enabling third-party MFA integration.
|
