Greetings. I am posting this request for references to any guides pertaining to the review and interpretation of results in Harmony Endpoint forensics results.
I am a relative novice when it comes to deciphering the significance of events being reported by Endpoint, and although I would enthusiastically say that it is in a whole nother galaxy compared to my previous platform (Datto AV/EDR), there is a LOT of information presented and I am unsure about how to put some of the details in context. I have been using Endpoint now for a few months, and am happy with the performance of detection and remediation, but I feel like there is more to understand about the various elements of a forensics report than the documentation provides.
What I need is a more complete walk through of the forensics report that breaks down each of the details in each section, ideally with some examples of events and remediation. My goal is to be able to identify what, if any, further action should be taken based on results. As an example, there have been a couple of events that clearly required restoring files from quarantine, such as components of our remote desktop broker product, TSPlus, that was effectively crippled as a result of the various triggers Endpoint executed. This also led to a hands on real time training on the ways to use Smart Exceptions. I am gradually getting a better understanding of what I am looking at in forensics, but it would be helpful to have a protocol to follow for reviewing all the info.
If there are videos or other resources available to admins that provide some guidance about proper Endpoint forensics review and follow up, I would be eternally grateful to whoever could point me in the right direction. In the mean time, I will continue to muddle through and hope that I am not missing something.
Thanks in advance.
-That One IT guy
