Magnet AXIOM to Magnet AXIOM CYBER Transition
Magnet AXIOM to CYBER Transitions is ideal for those who are looking to continue their education and transition into the unique features of AXIOM Cyber after taking the AXIOM Examinations (AX200) course.
MODULE 1: COURSE INTRODUCTION
- Learning objectives will be presented along with expected outcomes.
- Hands-on exercises will allow you to install Magnet AXIOM Cyber and learn about its associated programmatic components: AXIOM Process and AXIOM Examine.
MODULE 2: PRE-ACQUISITION AND PREPERATION
This module will focus on setting up environments appropriately in your environment for using AXIOM Cyber to do remote acquisitions.
- Windows settings and networking services will be covered to allow for AXIOM Cyber to acquire data from the Windows platform.
- macOS settings and permissions as well as networking services will be covered to allow for AXIOM Cyber to acquire data from the Windows platform.
- Topics around what can and cannot be acquired depending on the level of access will be covered.
MODULE 3: REMOTE ACQUISITION
- This module will cover the Remote Acquisition function of AXIOM Cyber and its options and various components.
- Students will learn how to build various agents for both Windows and macOS platforms.
- Information on connecting to multiple endpoints and surviving client shutdowns will be discussed.
- What types of images can be acquired from specific platforms will be covered.
- This module is meant to be consumed in a play/pause method so examiners can practice these steps in their own environments.
MODULE 4: CLOUD
- With the proliferation of cloud storage and the acceptance of it in both the corporate environment as well as the home-user environment, it is important for all examiners to understand the artifacts that remain in the cloud, which may not be stored on local media.
- Discovering cloud artifacts and putting together what the capabilities of AXIOM are, in reference to cloud collection and examination, will be discussed.
- Understanding how to use Admin-level accounts to acquire data without using a user’s direct credentials from services such as O365, Slack, and AWS.