What you'll learn

An encoded PowerShell command, a scheduled task, and a Run key provide evidence of persistence, but AI output alone can not confirm with confidence that there’s a connection between them. In this course, Windows Endpoint Security: AI-assisted Analysis, you’ll gain the ability to utilize AI efficiently and securely to assist with endpoint analysis. First, you’ll explore how to preserve Windows event logs, and prepare a sanitized package for AI review. Next, you’ll discover how to prompt AI to reduce the risk of hallucinations, identify each major claim brought by AI, and verify them against named records. Finally, you’ll learn how to go from receiving an endpoint alert, to inspecting scheduled tasks, Run values, and payloads, while reviewing and remediating them with the assistance of AI. When you’re finished with this course, you’ll have the skills and knowledge of AI-assisted Windows endpoint analysis needed to utilize AI in your workflow to accelerate triage while having concrete verification of presented information and keeping the final decisions to human control.