This course covers the Trellix Helix workflow, triaging Helix alerts, creating and scoping cases from an alert, and using Helix during an investigation.

Hands-on activities include writing TQL searches, as well as analyzing and validating Helix alerts.

• Determine which data sources are most useful for Helix detection and investigation
• Search log events across the enterprise
• Locate and use critical information in a Helix alert to assess a potential threat
• Create a case from events of interest
• Create and manage IAM users

Day 1

Helix Fundamentals

• Introducing Helix
• Features and capabilities
• Searching and pivoting
• Event parsing
• Custom dashboards

Search and Trellix Query Language (TQL)

• Searchable fields
• Anatomy of a TQL search
• TQL search, directories, and transform clauses

Day 2

Data Source Selection and the MITRE ATT&CK framework

• Data sources for detection and investigation
• Attack models to frame data source selection
• Using the MITRE ATT&CK framework
• Mapping attacker activity to the stages of an APT attack

Rules & Lists

• Best practices for writing rules
• Creating and enabling rules
• Creating and using lists
• Using regular expression in rules
• Multi-stage rules

Initial Alerts

• Helix alerts
• Guided Investigations
• Trellix Network Security alerts
• MVX engine
• Trellix Endpoint Security alerts
• Triage with Triage Summary
• Run searches across all hosts in the enterprise

Helix Case Management

• Creating a case in Helix
• Adding events to a case
• Case workflow

Network security professionals, incident responders and Trellix administrators and analysts who use Helix to analyze data in noisy event streams.

Students taking this course should have a working understanding of networking and network security, the Windows operating system, file system, registry, and use of the command line interface (CLI).