AX280 Enterprise Remote Endpoint Investigations

Description

Remote collection isn't a lecture topic — it's a skill you develop.

This course is engineered from the ground up around live, hands-on acquisition. Rather than working from static disk images, students target real, running endpoints across Windows, macOS, and Linux — the same way as in the field. Every module pairs concept with practice, providing the ability to perform remote collections and not just describe them.

A realistic, evolving investigation

The course is built around a unified investigative scenario that grows with you. Each module introduces a new employee of interest, layering in fresh background and evidence, then puts you to work investigating them using the remote collection techniques you've just learned. Purpose-built user accounts and curated artifacts are staged on the target systems, giving you authentic "subjects" to acquire and analyze at every stage. The modular design means the scenario stays fresh and current — and consistently relevant to real-world enterprise investigations.

Built for true hands-on learning

To make live, in-classroom remote acquisition possible, each mobile lab is equipped with a dedicated wireless access point — enabling students to create, deploy, and run collection agents against one another's machines across realistic network configurations. The course supports in-person, classroom, and virtual delivery, including cloud-based lab environments where each student works in their own isolated VM.

What to expect

The ability to plan and execute remote collections across Windows, macOS, and Linux; confidence navigating segmented enterprise networks; fluency with Axiom Cyber, Magnet Nexus, Hybrid agents, and Magnet Response; and the troubleshooting instincts that separate practitioners who understand remote acquisition from those who can actually do it.

Course modules

Module 1: Course Introduction & Lab Environment

• Orientation to the course, the investigative scenario, and the hands-on lab setup.

Module 2: DFIR Concepts for Remote Acquisition

• The core principles and decision-making behind modern remote collection.

Module 3: Axiom Cyber Architecture & Workflow

• A fully hands-on tour of creating, managing, and deploying remote collection agents across Windows, macOS, and Linux using Axiom Cyber.

Module 4: Windows Endpoint Collection

• Students deploy an agent and run a targeted collection against their own machine, then process and review the artifacts in Axiom Cyber — building core skills with no network complexity to distract.

Module 5: Remote Collection Fundamentals

• Working in teams across a shared private network, students deploy agents and collect from one another's endpoints, putting the full remote workflow into practice.

Module 6: Network Collection: Windows Endpoint via Axiom Cyber Agent.

• Grounded in the realities of network segmentation, DNS, IP addressing, firewall rules, and authentication, students perform cross-VLAN collections by hostname and develop the connectivity troubleshooting skills that define real-world remote acquisition work.

Module 7: Magnet Nexus & Hybrid Agents

• A closer look at Nexus, including creating cases, generating agents, and watching collections come to life as agents call home.

Module 8: Network Collection: macOS via Nexus Agent

• Extending remote collection to macOS endpoints using the Nexus agent.

Module 9: Network Collection: Linux Endpoint via Hybrid Agent

• Acquiring from a Linux target populated with scenario data, including coverage of MCAG/UCAG collection approaches.

Module 10: Magnet Response & Triage Lab.

• Where Response fits in the toolkit, when to use it, and how it complements Axiom Cyber and Nexus — with a hands-on lab running Response, reviewing artifacts in Examine, and validating the collection.

Module 11: Automation & Wrap-Up

• Automating remote agent deployment through EDR/SOAR workflows and base-image integration, leveraging Magnet Response within EDR alert response, and best practices for collection decision-making and avoiding over-collection.

Module 12: Capstone Exercise.

• A segmented, hands-on challenge that reinforces every skill from the week — and serves as a take-home practice resource to keep building after class.

‍