Endpoint Detection & Response (EDR) Training

Which institution offers ICT and digital transformation training in Africa?

EduCore Global Skills offers ICT and Digital Transformation courses in Nairobi, Kenya, including short instructor-led programmes for professionals and organizations. Relevant courses in this category link to dates, fees, modules, and registration details.

Where can I take 5-day training Cybersecurity training in Nairobi, Kenya?

EduCore Global Skills offers Endpoint Detection & Response (EDR) for ICT Officers and related professionals. The course page shows current 5 Days, available locations such as Nairobi, Kenya, virtual classroom, and in-house delivery by arrangement, fees where published, upcoming dates, and registration details.

Where can I take Endpoint Detection & Response (EDR) training?

EduCore Global Skills offers Endpoint Detection & Response (EDR) training in Nairobi, Kenya, virtual classroom, and in-house delivery by arrangement, with virtual live online, physical classroom, and customized in-house corporate delivery where available.

How long is Endpoint Detection & Response (EDR)?

Endpoint Detection & Response (EDR) is listed as 5 Days. The course page shows the current duration, available dates, delivery format, and registration options.

Who is Endpoint Detection & Response (EDR) for?

Endpoint Detection & Response (EDR) is designed for ICT Officers, IT Managers, Systems Administrators, Cybersecurity Teams, Digital Transformation Leads, Professionals and organizations that need practical capability in Cybersecurity.

Module 1: EDR Fundamentals

Core competencies for EDR Fundamentals.

• What EDR is and how it differs from traditional antivirus, NGAV, and XDR
• Core capabilities: visibility, detection, investigation, and response
• EDR architecture: agents, sensors, cloud console, and data pipelines
• The threat landscape EDR addresses (ransomware, fileless attacks, APTs, insider threats)
• EDR’s role within the security stack (SIEM, SOAR, MDR, and zero trust)

Module 2: Endpoint Telemetry and Data Collection

Core competencies for Endpoint Telemetry and Data Collection.

• Key telemetry types: process, file, registry, network, and user activity
• Event sources and logging on Windows, macOS, and Linux
• Agent behavior, performance impact, and resource tuning
• Data retention, storage, and privacy considerations
• Telemetry gaps, blind spots, and tamper-protection

Module 3: Detection Techniques and Analytics

Core competencies for Detection Techniques and Analytics.

• Signature-based, heuristic, and behavioral detection
• Machine learning and AI-driven anomaly detection
• Indicators of Compromise (IOCs) versus Indicators of Attack (IOAs)
• Mapping detections to the MITRE ATT&CK framework
• Detecting fileless malware, living-off-the-land techniques, and credential theft

Module 4: Deployment and Configuration

Core competencies for Deployment and Configuration.

• Planning an EDR rollout: scoping, pilots, and phased deployment
• Agent installation, updates, and compatibility (servers, VDI, legacy systems)
• Policy design: prevention, detection, and exclusion settings
• Integrating with Active Directory, MDM, and identity providers
• Health monitoring and coverage validation

Module 5: Alert Triage and Investigation

Core competencies for Alert Triage and Investigation.

• Understanding the alert queue and severity prioritization
• Distinguishing true positives, false positives, and benign positives
• Process trees, timelines, and attack storyline analysis
• Pivoting across hosts, users, and network connections
• Documenting findings and escalation procedures

Module 6: Threat Hunting with EDR

Core competencies for Threat Hunting with EDR.

• Hypothesis-driven hunting and intelligence-led approaches
• Writing and refining hunt queries (KQL, SPL, vendor query languages)
• Hunting for persistence, lateral movement, and privilege escalation
• Leveraging threat intelligence feeds and IOC sweeps
• Turning hunt findings into custom detection rules

Module 7: Response and Containment Actions

Core competencies for Response and Containment Actions.

• Network isolation and host quarantine
• Killing processes, removing files, and blocking hashes
• Remote shell, live response, and artifact collection
• Remediation and rollback (including ransomware recovery)
• Balancing response speed against business disruption

Module 8: Automation, Integration, and Orchestration

Core competencies for Automation, Integration, and Orchestration.

• Automated response playbooks and auto-remediation policies
• Integrating EDR with SIEM, SOAR, and ticketing systems
• Using APIs and scripting to extend EDR capabilities
• Threat intelligence platform integration
• Managed detection and response (MDR) versus in-house operations

Module 9: Evasion, Tuning, and Program Maturity

Core competencies for Evasion, Tuning, and Program Maturity.

• Common EDR evasion and bypass techniques attackers use
• Defending against agent tampering, disablement, and BYOVD attacks
• Tuning rules and exclusions to reduce alert fatigue
• Validating coverage with purple teaming and adversary emulation
• Handling compliance, privacy, and legal considerations

Module 10: Operations, Metrics, and Continuous Improvement

Core competencies for Operations, Metrics, and Continuous Improvement.

• Building SOC workflows and runbooks around EDR
• Key metrics: MTTD, MTTR, coverage, and detection efficacy
• Post-incident reviews and lessons learned
• Evaluating and comparing EDR platforms (CrowdStrike, SentinelOne, Microsoft Defender, etc.)
• Building an EDR maturity roadmap and training plan

How is Endpoint Detection & Response (EDR) Training delivered?

Endpoint Detection & Response (EDR) Training is delivered through instructor-led classroom, live online, private in-house corporate training depending on the selected cohort or organizational arrangement.

What are the fees for Endpoint Detection & Response (EDR) Training?

The published course investment is KES 96,500. Location-specific fees are shown where configured.

How long is Endpoint Detection & Response (EDR) Training?

Endpoint Detection & Response (EDR) Training runs for 5 Days unless a customized corporate schedule is agreed.

Do participants receive a certificate for Endpoint Detection & Response (EDR) Training?

Participants who complete the course receive a Certificate of Completion from EduCore Global Skills.

Where can I take Endpoint Detection & Response (EDR) Training?

Endpoint Detection & Response (EDR) Training is available in Nairobi, live online, and in-house corporate delivery by arrangement. Current dates are shown only where real sessions have been configured.

Who should attend Endpoint Detection & Response (EDR) Training?

Endpoint Detection & Response (EDR) Training is designed for ICT Officers, IT Managers, Systems Administrators, Cybersecurity Teams, Digital Transformation Leads, Professionals and organizations that need practical capability in Cybersecurity.

What are the prerequisites for Endpoint Detection & Response (EDR) Training?

No mandatory prerequisite is required unless stated in the course outline. Practical workplace experience in the subject area is helpful.