The training shows how to analyze incidents using the event chain, timeline view, and how to use advanced methods of responding to attacks, e.g. suggestions, EDL lists, remote execution of Python scripts.

Many modules focus on how to use the collected data. It teaches how to create simple queries for searching for key elements, events and how to create XDR rules. The training demonstrates how to use advanced views for deep analysis of security incidents, taking into account artifacts (e.g. IP, hash). Additionally, the course introduces XQL (XDR Query Language). Finally, issues related to collecting data from external sources and using the capabilities of the API are discussed.