Catalog

Course Length: 2 days Overview: This course provides a framework for administration and day-to-day use of the Trellix Email Security – Server, including deployment, configuration, basic administration, and analysis of malicious emails. Learners will triage Trellix-generated alerts and derive actionable information to assess threats to their environment. The course also includes: Checklists Case studies Guidance for transitioning difficult cases to the Trellix Support team Hands-on activities provide learners with experience administering Email Security – Server, diagnosing common issues, and triaging alerts generated from malicious files and URLs in email to identify malware and other unwanted intrusions. Who Should Attend: Security analysts, incident responders, and email administrators responsible for the setup and management of Email Security – Server and who use Email Security – Server to detect, investigate, and prevent cyber threats. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 16 Hours
• 1 lesson
• 61
• Advanced

Course Length: 4 days Overview: This course examines how to triage alerts generated by the Trellix Network Security and Endpoint Security (HX) platforms, derive actionable information from those alerts, and inspect affected endpoints using live analysis and investigation fundamentals. Hands-on activities span the entire analysis and live investigation process, beginning with a Trellix-generated alert, leading to discovery and analysis of the host for evidence of malware and other unwanted intrusion. Endpoint analysis focuses on investigation techniques using features of Endpoint Security (HX), such as: Triage Summary Audit Viewer Acquisitions Who Should Attend: Security analysts, incident responders, and threat hunters who use Network Security and Endpoint Security (HX) to detect, investigate, and prevent cyber threats. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 02/16/2027 9:00AM - 02/19/2027 4:00PM
• 32 Hours
• 1 lesson
• 267
• Advanced

Course Length: 2 days Overview: This course examines how to triage alerts generated by Trellix Network Security, derive actionable information from those alerts, and apply the fundamentals of live analysis and investigation to investigate associated endpoints. Course Highlights: Hands-on activities span the entire analysis and live investigation process, beginning with a Trellix-generated alert, leading to discovery and analysis of the host for evidence of malware and other unwanted intrusion. Analysis will be performed using Trellix products and freely available tools. Who Should Attend: Security analysts, incident responders, and network security professionals who use Network Security to detect, investigate, and prevent cyber threats. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/11/2027 9:00AM - 01/12/2027 4:00PM
• 24 Hours
• 1 lesson
• 255
• Advanced

Course Length: 4 days Overview: The Trellix Application and Change Control Administration course from Education Services provides in-depth training on the tools you need to efficiently install, configure, operate, and troubleshoot issues relating to TACC to safeguard intellectual property and ensure compliance. Course Highlights: The course details how this solution uses Trellix ePolicy Orchestrator (Trellix ePO) for centralized management. It also explains how to use Application Control for dynamic allowlisting to ensure that only trusted applications run on devices, servers, and desktops and how to use Change Control to monitor and prevent changes to the file system, registry, and user accounts. Who Should Attend: System and network administrators, security personnel, auditors, and/or consultants concerned with system security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 02/23/2027 9:00AM - 02/26/2027 3:00PM
• 32 Hours
• 1 lesson
• 202
• Advanced

Released: 16-Oct-2026 Course Duration: 4 days This course provides in-depth training on the tools needed to design, implement, configure, and use Trellix Data Loss Prevention Endpoint to safeguard intellectual property and ensure compliance. Additionally, the course details how to integrate and leverage Trellix ePolicy Orchestrator (ePO) for centralized management and policy enforcement. Who Should Attend: This course is intended for Security and Network administrators, IT professionals, Cybersecurity engineers, IT Audit, Governance and Compliance officers responsible for safeguarding sensitive corporate data, ensuring regulatory compliance, and managing policy enforcement. Download PDF Course Data Sheet

• 01/19/2027 9:00AM - 01/22/2027 3:00PM
• 32 Hours
• 1 lesson
• 474
• Advanced

Course Length: 4 days Overview: The Trellix Data Loss Prevention Network Administration course from Education Services provides in-depth training on the tools you need to design, implement, configure, and use Data Loss Prevention Network to safeguard intellectual property and ensure compliance. The course details how this solution uses Trellix ePolicy Orchestrator (ePO) software for centralized management. It also explains how to monitor and address risky, day-to-day end-user actions such as: Emailing Web posting Printing Clipboards Screen captures Device control Uploading to the cloud Who Should Attend: System and network administrators, security personnel, auditors, and/or consultants concerned with system endpoint security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 32 Hours
• 1 lesson
• 118
• Advanced

Course Length: 2 days Overview: The Trellix Database Security Administration course from Education Services is an essential component to monitor and protect the Database Management System (DBMS). Course Highlights: In hands-on lab sessions, you will learn how to deploy and configure a Database Security solution to protect the Database Management System (DBMS) from internal and external threats, as well as intra-database exploits. You can immediately apply your new skills to improve protection for your business and take full advantage of your investment in our Database Security solution. Who Should Attend: System administrators, security personnel, auditors, and/or consultants concerned with system security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/19/2027 9:30AM - 01/20/2027 5:00PM
• 16 Hours
• 1 lesson
• 95
• Advanced

Course Length: 4 days Overview: This entry-level course in digital forensics and incident response provides foundational knowledge in: Incident response preparation Detection and analysis Containment Eradication Recovery Post-incident activities, including lessons learned This course employs open-source tools to perform triage and forensics analysis in hands-on labs, touching on the key artifacts of Microsoft Windows, Linux, and Apple macOS systems. This course is part of the Trellix Cyber Operations team’s Foundations in Incident Response Education (FIRE) track of general defensive security training. Learners are provided a blend of lecture, discussions, and hands-on labs. Who Should Attend: This course is intended for incident responders, information security staff, auditors, SOC analysts, investigators, and consultants responsible for digital forensics and incident response. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 04/05/2027 9:30AM - 04/08/2027 5:00PM
• 1 lesson
• 94
• Advanced

Course Length: 4 days Overview: The Trellix Drive Encryption Administration course from Education Services provides an in-depth introduction to the tasks crucial to set up and administer Drive Encryption. Course Highlights: Drive Encryption is full disk encryption software that helps protect data on Microsoft Windows tablets, laptops, and desktop PCs to prevent the loss of sensitive data, especially from lost or stolen equipment. This course combines lectures and practical lab exercises, with significant time allocated for hands-on interaction with virtual lab systems, as well as detailed instructions for the integration of this solution. Who Should Attend: System and network administrators, security personnel, auditors, and/or consultants concerned with system endpoint security and drive encryption. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 32 Hours
• 1 lesson
• 39
• Intermediate

Course Length: 2 days Overview: The Trellix Endpoint Detection and Response Administration course from Education Services prepares SOC Analysts to understand, communicate, and use the features provided by Endpoint Detection and Response (EDR). Course Highlights: Trellix EDR helps to manage the high volume of alerts, empowering analysts of all skill levels to do more and investigate more effectively. Through hands-on lab exercises, you will learn how to detect advanced device threats, fully investigate, and quickly respond. Who Should Attend: Analysts and/or Engineers responsible for configuration, management, and monitoring activity on their systems, networks, databases and applications using the EDR solution. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 02/09/2027 9:30AM - 02/10/2027 5:00PM
• 16 Hours
• 1 lesson
• 286
• Intermediate

Course Length: 4 days Overview: This course provides IT Administrators, Security Analysts, and Incident Responders with the specialized knowledge required to deploy, configure, and utilize the Trellix EDRF ecosystem. The curriculum focuses on the integration of traditional EDR capabilities with deep-dive forensic artifacts. Key highlights include: The leverage of Trellix Wise for automated investigations The utilization of enhanced forensic collection modules (Command Shell, PowerShell, and Full Memory acquisition) The implementation of advanced remediation workflows Participants will learn to move beyond simple alert monitoring to proactive threat hunting using the specialized Endpoint Detection and Response and Forensics Workspaces. Who Should Attend: This course is intended for IT Administrators, Security Analysts, and Incident Responders concerned with system endpoint security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/05/2027 9:00AM - 01/08/2027 3:00PM
• 24 Hours
• 1 lesson
• 61
• Intermediate

Course Length: 2 days Overview: This course equips Security Analysts and Incident Responders to detect, investigate, and remediate endpoint threats using Trellix EDR with Integrated Forensics On-Premises (EDRF On-Prem). Designed for air-gapped, high-security, or regulated environments, it covers a localized three-server topology: ePolicy Orchestrator (ePO) On-Premises, Forensics HX Controller, and EDRF Telemetry Store (OpenSearch cluster) connected via Data Exchange Layer (DXL). Core topics include: Monitoring host alerts Threat hunting with Historical Search, Enterprise Search, Process and Logon Trackers Obtaining forensic acquisitions (File, Triage, Data) Auditing evidence via Audit Viewer Localized containment with remote shell remediation This course also includes usage of the ETS Explorer and HX Tool. Who Should Attend: Security Analysts, Incident Responders, and Threat Hunters concerned with Endpoint Security and Forensic investigation. Download PDF Course Data Sheet

• 01/20/2027 9:00AM - 01/22/2027 4:00PM
• 16 Hours
• 1 lesson
• 24
• Advanced

Course Length: 4 days Overview: The Trellix Endpoint Security - SaaS with Trellix ePolicy Orchestrator - SaaS Administration course from Education Services provides an in-depth introduction to the tasks crucial to set up and administer Endpoint Security - SaaS in an ePO - SaaS managed customer environment. Course Highlights: Endpoint Security - SaaS leverages and enhances built-in Windows 10 Windows Defender security with advanced protection for Windows 10 and Windows Server 2016 and newer systems. ePO - SaaS is a SaaS-based centralized security management console that enables management of Microsoft Defender along with Trellix security products. This course combines lectures and practical lab exercises, with significant time allocated for hands-on interaction with the Endpoint Security - SaaS policies in the ePO - SaaS user interface, as well as detailed instructions for the integration of this solution. Who Should Attend: System and network administrators, security personnel, auditors, and/or consultants concerned with administering Endpoint Security - SaaS on ePO - SaaS. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 32 Hours
• 1 lesson
• 22
• Intermediate

Course Length: 4 days Overview: This course provides an in-depth introduction to the tasks crucial to set up and administer Trellix Endpoint Security (ENS). Endpoint Security combines Threat Prevention, Adaptive Threat Protection, Firewall, and Web Control to take immediate action against potentially dangerous applications, downloads, websites, and files. This course combines lectures and practical lab exercises, with significant time allocated for hands-on interaction with the Endpoint Security client user interface and policies, as well as detailed instructions for the integration of this solution. Learning Objectives: After completing this course, learners should be able to: Plan an Endpoint Security deployment Install required software components Configure and use the Threat Prevention, Adaptive Threat Protection, Firewall, and Web Control components Monitor and report on security status Identify the other security solutions with which ENS integrates, as well as the integration requirements and procedures Who Should Attend: This course is intended for system and network administrators, security personnel, auditors, and/or consultants concerned with system endpoint security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/18/2027 9:30AM - 01/21/2027 5:00PM
• 32 Hours
• 1 lesson
• 279
• Intermediate

Course Length: 5 days Overview: This course provides an in-depth introduction to the tasks crucial to set up and administer Trellix Endpoint Security (ENS). Endpoint Security combines Threat Prevention, Adaptive Threat Protection, Firewall, and Web Control to take immediate action against potentially dangerous applications, downloads, websites, and files. This course combines lectures and practical lab exercises, with significant time allocated for hands-on interaction with the Endpoint Security client user interface and policies, as well as detailed instructions for the integration of this solution. Learning Objectives: After completing this course, learners should be able to: Plan an Endpoint Security deployment Install required software components Configure and use the Threat Prevention, Adaptive Threat Protection, Firewall, and Web Control components Monitor and report on security status Identify the other security solutions with which ENS integrates, as well as the integration requirements and procedures Who Should Attend: This course is intended for system and network administrators, security personnel, auditors, and/or consultants concerned with system endpoint security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 02/01/2027 9:00AM - 02/05/2027 5:00PM
• 40 Hours
• 22 lessons
• 117
• Intermediate

Course Length: 5 days Overview: The Endpoint Security ENS Expert Rules Creation Advanced course from Education Services provides insights into our proprietary syntaxes and an advanced view into Operating System concepts and references needed to better understand how ENS works. Course Highlights: Building on the ENS Platform, ENS Expert Rules allow the advanced ENS administrator to add deeper security to their ENS deployment. This course helps administrators fully comprehend how ENS Expert Rules can provide a more customized and secure environment. Who Should Attend: System and network administrators, security personnel, auditors, and/or consultants concerned with system endpoint security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 02/15/2027 1:00PM - 02/19/2027 8:00PM
• 40 Hours
• 1 lesson
• 53
• Advanced

Course Length: 1 day Overview: This course provides a framework for administration and diagnostics of the Trellix Endpoint Security (HX) server and the Trellix xAgent. Course Highlights: The course introduces deployment, configuration and basic administration for Trellix Endpoint Security (HX), and includes checklists, case studies and guidance for transitioning difficult cases to the Trellix Support team. Optional modules include Trellix core hardware and virtual appliances. Hands-on activities provide learners with experience administering the appliance and diagnosing common issues. Who Should Attend: System administrators responsible for implementing and maintaining the Endpoint Security (HX) server and endpoint agent (xAgent). To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 02/12/2027 9:00AM - 02/12/2027 4:00PM
• 8 Hours
• 1 lesson
• 581
• Intermediate

Course Length: 4 days Overview: The Trellix ePolicy Orchestrator – On-prem Administration course enables attendees to receive in-depth training on the benefits of the centralized management and deployment of products using ePolicy Orchestrator (ePO) – On-prem software. Course Highlights: Enabling administrators to fully understand the capabilities of their security solution not only reduces the risks of misconfiguration, but also ensures that an organization gets the maximum protection from installation. This course combines lectures and practical lab exercises with significant time allocated for hands-on interaction with all user interfaces. Who Should Attend: This course is intended for system and network administrators, security personnel, auditors, and/or consultants concerned with networking and system administration. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/12/2027 9:00AM - 01/15/2027 3:00PM
• 32 Hours
• 1 lesson
• 468
• Intermediate

Course Length: 5 days Overview: The Trellix ePolicy Orchestrator – On-prem Administration course from Education Services enables attendees to receive in-depth training on the benefits of the centralized management and deployment of products using ePolicy Orchestrator (ePO) software. Course Highlights: Enabling administrators to fully understand the capabilities of their security solution not only reduces the risks of misconfiguration, but also ensures that an organization gets the maximum protection from installation. This course combines lectures and practical lab exercises, with significant time allocated for hands-on interaction with the ePO – On-prem interface. Who Should Attend: System and network administrators, security personnel, auditors, and/or consultants concerned with system administration. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/25/2027 9:00AM - 01/29/2027 5:00PM
• 40 Hours
• 1 lesson
• 241
• Intermediate

Course Length: 4 days Overview: The Trellix ePolicy Orchestrator - On-prem Advanced Topics course from Education Services provides in-depth training on the advanced capabilities of ePolicy Orchestrator (ePO) - On-prem software. Through lecture, hands-on labs, and class discussions, you will learn how to use ePO advanced capabilities and practice using tools for: Upgrades and migrations Monitoring Maintenance and troubleshooting Advanced policy configuration Who Should Attend: System and network administrators, security personnel, auditors, and/or consultants concerned with network and system security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/25/2027 9:30AM - 01/28/2027 5:00PM
• 32 Hours
• 1 lesson
• 174
• Advanced

Course Length: 2 days Overview: This course covers: The Trellix Helix workflow Triaging Helix alerts Creating and scoping cases from an alert Using Helix during an investigation Hands-on activities include configuring data sources, writing TQL searches, as well as analyzing and validating Helix alerts. Who Should Attend: Network security professionals, incident responders, and Trellix administrators and analysts who use Helix to analyze data in noisy event streams. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 11/11/2026 9:00AM - 11/12/2026 5:00PM
• 16 Hours
• 163
• Intermediate

Course Length: 4 days Overview: The Trellix Intelligent Sandbox with DXL and TIE Administration course from Education Services provides an in-depth look at each of the products and how they integrate. Course Highlights: In this course, you will learn the tasks crucial to set up, administer, and manage Trellix Intelligent Sandbox (TIS), Data Exchange Layer (DXL), and Threat Intelligence Exchange (TIE) solutions. This combined solution enables you to gain better visibility of your environment, protecting and limiting exposure to threats and vulnerabilities. This course combines lectures and practical lab exercises, with significant time allocated for hands-on interaction with the TIS, DXL, and TIE user interfaces, as well as detailed instructions for the integration of this solution. Who Should Attend: System and network administrators, security personnel, auditors, and/or consultants concerned with network and system security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 32 Hours
• 1 lesson
• 48
• Intermediate

Course Length: 1 day Overview: This course provides an in-depth look at Trellix Intelligent Virtual Execution (IVX) - Server. In this course, you will learn the tasks crucial to configure, administer, and manage IVX - Server. Course Highlights: You will also learn how to submit malware for analysis and how IVX integrates with other Trellix products, enabling you to gain better visibility of your environment, protecting and limiting exposure to threats and vulnerabilities. This course combines lectures and practical lab exercises with significant time allocated for hands-on interaction with user interfaces. Who Should Attend: This course is intended for system and network administrators, security personnel, auditors, and/or consultants concerned with system administration. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/26/2027 9:00AM - 01/26/2027 4:00PM
• 8 Hours
• 1 lesson
• 45
• Intermediate

Course Length: 4 days Overview: The Trellix Network Security Platform Administration course from Education Services is an essential component of implementing a successful intrusion prevention strategy. Course Highlights: In hands-on lab sessions, you’ll learn how to deploy and configure a Network Security Platform solution to protect against real-world attacks. You can immediately apply your new skills to improve protection for your business and take full advantage of your investment in our Trellix Network Security Platform. Who Should Attend: System and network administrators, security personnel, auditors, and/or consultants concerned with network and system security. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/12/2027 9:00AM - 01/15/2027 4:00PM
• 32 Hours
• 1 lesson
• 274
• Intermediate

Course Length: 1 day Overview: This course provides an overview of Trellix Email Security – Cloud core functionality and covers administration procedures and alert analysis. Hands-on activities include: Rule/policy creation Alert generation The breakdown and analysis of information found in a Trellix email alert that is used in incident reporting Who Should Attend: This course is intended for analysts (primary) and administrators responsible for the setup and management of Email Security – Cloud and who use Email Security – Cloud to detect, investigate, and prevent cyber threats. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 8 Hours
• 1 lesson
• 92
• Advanced

Course Length: 3 days Overview: This course examines how to triage Trellix-generated alerts, derive actionable information from those alerts, and inspect affected endpoints using live analysis and investigation fundamentals. Hands-on activities span the entire analysis and live investigation process, beginning with a Trellix-generated alert, leading to discovery and analysis of the host for evidence of malware and other unwanted intrusion. Endpoint analysis focuses on investigation techniques using features of Endpoint Security (HX), such as: Triage Summary Audit Viewer Acquisitions Who Should Attend: Security analysts, incident responders, and threat hunters who use Endpoint Security (HX) to detect, investigate, and prevent cyber threats. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 01/19/2027 9:00AM - 01/21/2027 4:00PM
• 24 Hours
• 1 lesson
• 646
• Advanced

Course Length: 4 days Overview: This entry-level course in malware analysis provides foundational knowledge in: Malware history Safe malware sample handling Analysis methodologies and techniques Sandboxing Triage Countermeasures This course employs open-source tools in hands-on labs to analyze samples including packed executables, cross-platform, Office, PDF, and more. This course is part of the Trellix Cyber Operations team’s Foundations in Incident Response Education (FIRE) track of general defensive security training. Learners are provided a blend of lecture, discussions, and hands-on labs. Who Should Attend: This course is intended for incident responders, information security staff, auditors, SOC analysts, investigators, and consultants responsible for digital forensics and incident response. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 03/01/2027 9:30AM - 03/04/2027 5:00PM
• 32 Hours
• 71
• Advanced

Course Length: 1 day Overview: This course provides a framework for administration and diagnostics, including deployment, configuration and basic administration, of one or more of the following Trellix appliances: Network Security Email Security – Server File Protect Malware Analysis Central Management The course includes checklists, case studies, lab challenges and guidance for transitioning difficult cases to the Trellix Support team. Hands-on activities provide learners with experience administering these appliances and diagnosing common issues. Who Should Attend: System administrators responsible for implementing and maintaining one or more of the following Trellix appliances: Network Security, Email Security – Server, File Protect, Malware Analysis, and Central Management. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 8 Hours
• 1 lesson
• 192
• Intermediate

Course Length: 1 day Overview: This course provides an overview of the Network Detection and Response Solution and discusses the NDR console. The course focuses on how NDR can integrate with: Network sensors Packet Capture (PX) Network Security (NX) Intrusion Prevention System (IPS) The course provides an overview of each appliance, their standard network deployments, and how they function within the NDR system. This course also reviews NDR’s integration with other Trellix products like SIEM, ePO, and Tenable Security. It discusses how Trellix NDR with Trellix Wise leverages AI agents to detect and disrupt attacker activity, and accelerate investigation and response. This course combines lectures and practical lab exercises with significant time allocated for hands-on interaction with all user interfaces. Who Should Attend: This course is intended for system and network administrators, security personnel, auditors, and/or consultants concerned with networking and system administration. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 02/09/2027 9:00AM - 02/09/2027 4:00PM
• 8 Hours
• 1 lesson
• 84
• Intermediate

Course Length: 2 days Overview: This course covers the fundamentals and concepts of Network Traffic Analysis. Course Highlights: It is designed to help Network Analysts learn how to search, filter, analyze, reconstruct, and preserve network traffic, and to apply techniques to conduct a network forensics investigation using the Network Detection and Response (NDR) solution. The course combines lectures and practical lab exercises with significant time allocated for hands-on interaction with all user interfaces. Who Should Attend: Network security professionals and incident responders who use Trellix Packet Capture and Investigation Analysis appliances to analyze cyber threats through packet data. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 02/04/2027 9:00AM - 02/05/2027 3:00PM
• 16 Hours
• 1 lesson
• 17
• Advanced

Course Length: 1 day Overview: This entry-level course covers deployment options, basic administration, and configuration of the integrated Trellix technologies for the Trellix Network Forensics appliances—Packet Capture and Investigation Analysis. Hands-on activities include: Post-installation tasks System health checks Pairing a Packet Capture appliance with the Investigation Analysis system Daily system administration tasks Configuring Event Based Capture Integration of another Trellix system for alerts Who Should Attend: Network security professionals and system administrators who operate and administer Trellix Packet Capture and Investigation Analysis appliances and integrate them with other Trellix technologies. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 8 Hours
• 1 lesson
• 28
• Intermediate

Course Length: 1 day Overview: This course provides a framework for administration and diagnostics, including deployment, configuration and basic administration, of Trellix Network Security. The course includes: Checklists Case studies Lab challenges Guidance for transitioning difficult cases to the Trellix Support team Hands-on activities provide learners with experience administering Trellix Network Security and diagnosing common issues. Who Should Attend: System administrators responsible for implementing and maintaining Network Security appliances. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 8 Hours
• 1 lesson
• 179
• Intermediate

Course Length: 4 days Overview: The Trellix SIEM course from Education Services prepares Trellix SIEM engineers and analysts to understand, communicate, and use the features provided by Trellix Enterprise Security Manager. Course Highlights: Trellix SIEM provides near real-time visibility into the activity on all your systems, networks, databases, and applications, enabling you to detect, correlate, and remedy threats in minutes across your entire IT infrastructure. Through hands-on lab exercises, you will learn how to optimize the Trellix Enterprise Security Manager by using Trellix-recommended best practices and methodologies. Who Should Attend: Enterprise Security Manager users responsible for monitoring activity on systems, networks, databases, applications, and for configuration and management of the Enterprise Security Manager. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 32 Hours
• 1 lesson
• 110
• Intermediate

Course Length: 4 days Overview: The Trellix SIEM Advanced course from Education Services prepares Trellix SIEM engineers and analysts to understand, communicate, and use the features provided by Enterprise Security Manager. Course Highlights: Trellix Enterprise Security Manager—the heart of our Security Information and Event Management (SIEM) solution—provides near real-time visibility into the activity on all your systems, networks, databases, and applications, enabling you to detect, correlate, and remedy threats in minutes across your entire IT infrastructure. Through demonstration, explanation, and hands-on lab exercises, you will learn how to utilize the Enterprise Security Manager by using Trellix-recommended best practices and methodologies. Who Should Attend: Enterprise Security Manager users responsible for monitoring activity on systems, networks, databases, applications, and for configuration and management of the Enterprise Security Manager. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 32 Hours
• 1 lesson
• 43
• Advanced

Course Length: 4 days Overview: This entry-level course in threat hunting and threat intelligence provides foundational knowledge in threat hunting methodologies and techniques, including the application of information security frameworks and threat intelligence. This course employs open-source tools to perform threat hunting and analysis in hands-on labs, touching on threat hunting use cases, hunting techniques, and key tactics. This course is part of the Trellix Guardians team’s Foundations in Incident Response Education (FIRE) track of general defensive security training. Learners are provided a blend of lecture, discussions, and hands-on labs. Key Learning Objectives: Threat Hunting Fundamentals: Understand foundational threat hunting methodologies, techniques, use cases, and key tactics. Threat Intelligence and Security Frameworks: Understand threat intelligence and the application of information security frameworks. Hands-On Threat Hunting: Use open-source tools to perform threat hunting and analysis through practical lab exercises. Who Should Attend: This course is intended for incident responders, information security staff, auditors, SOC analysts, investigators, and consultants responsible for digital forensics and incident response. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 11/16/2026 9:30AM - 11/19/2026 5:00PM
• 32 Hours
• 122
• Intermediate

Course Length: 4 days Overview: This course provides an in-depth look at each of these Trellix products and how they integrate. In this course, you will learn the tasks crucial to configure, administer, manage, and troubleshoot Intelligent Virtual Execution (IVX), Data Exchange Layer (DXL), and Threat Intelligence Exchange (TIE) solutions. This combined solution enables you to gain better visibility of your environment, protecting and limiting exposure to threats and vulnerabilities. This course combines lectures and practical lab exercises with significant time allocated for hands-on interaction with the IVX, DXL, and TIE user interfaces, as well as detailed instructions for the integration of this solution. Key Learning Objectives: Product Configuration and Administration: Learn the tasks required to configure, administer, and manage Intelligent Virtual Execution (IVX), Data Exchange Layer (DXL), and Threat Intelligence Exchange (TIE) solutions. Troubleshooting: Develop an understanding of how to troubleshoot IVX, DXL, and TIE solutions. Solution Integration: Understand how IVX, DXL, and TIE integrate to provide better visibility into the environment and help protect against threats and vulnerabilities. Hands-On Product Experience: Gain practical experience using the IVX, DXL, and TIE user interfaces through lab exercises and detailed integration instructions. Who Should Attend: This course is intended for system and network administrators, security personnel, auditors, and/or consultants concerned with system administration. To learn more about this course, or to schedule a private session for your team, contact your Trellix account manager. Download PDF Course Data Sheet

• 32 Hours
• 1 lesson
• 24
• Advanced