Collaboration Security Analyst for the AI Era

Module 1: Incident Response and the Threat Landscape

• Distinguish between events, alerts, and incidents
• Understand the incident response lifecycle
• Explain the relationship between vulnerability, threat, risk, and incident
• Understand the role of information security frameworks
• Identify common threat actors, their motivations, and attack vectors
• Explain how threat intelligence supports prioritisation, investigation, and response

Module 2: Product Overview

• Identify the core products in the Collaboration Security platform
• Explain the roles of Email Protection, TAP, Threat Response, and Workbench
• Understand how these products work together during investigations and response
• Understand the purpose of operational checks and data retention
• Recognise how the platform supports analyst workflows

Module 3: Email Threats, Filtering and Investigation

• Identify common email attacks, including phishing, business email compromise, and account takeover
• Use threat intelligence to stay informed about email threats
• Understand SMTP email flow and Email Protection filtering
• Explain SPF, DKIM, and DMARC
• Use authentication results to support spoofing analysis
• Investigate suspicious email activity with Smart Search
• Interpret message metadata
• Use threat intelligence and Smart Search data for threat hunting

Module 4: Threats and the TAP Dashboard

• Understand how TAP protects against URL, attachment, and message threats
• Prioritise and interpret threats, evidence, and attack progression using the Threats page
• Identify impacted and at-risk users
• Analyse condemnation sources and forensic evidence
• Identify high-risk users using the People page and reports
• Review Very Attacked People (VAPs) and account takeover activity
• Use custom URL blocklists, TAP notifications, and reports to support investigations and response

Module 5: Collaboration Protection and Supplier Threat Protection

• Understand the risks associated with collaboration tools
• Explain how Collaboration Protection blocks malicious URLs
• Investigate collaboration threats using Workbench and TAP data
• Understand how Supplier Threat Protection identifies compromised third parties
• Prioritise suspected compromised supplier accounts
• Analyse business relationships and traffic context
• Identify employees who communicated with suspected compromised accounts
• Assess supplier-related risk

Module 6: Threat Response and Remediation

• Understand the purpose of Threat Response and TRAP
• Explain how Threat Response and TRAP work with TAP
• Interpret quarantine statuses
• Troubleshoot common remediation failures
• Review and prioritise incidents and messages in Cloud Threat Response
• Document investigation findings
• Prepare incidents for escalation and remediation
• Export Smart Search results to Threat Response
• Use manual workflows, including CLEAR verdicts and mail bombing remediation

Module 7: The Threat Protection Workbench

• Navigate the Threat Protection Workbench interface
• Perform threat hunting and investigations
• Analyse messages, senders, threats, and campaigns
• Use Query Builder, Email Insights, ThreatFlip, Satori, and other Workbench tools
• Perform investigation and remediation actions from a single analyst workspace

Module 8: Dealing with False Positives and False Negatives

• Distinguish false positives from false negatives
• Review evidence before reporting detection errors
• Use TAP, Workbench, and support options to report issues
• Understand how PTIS and analyst support help validate detections
• Apply corrective actions to improve detection quality

Module 9: Incident Documentation and Proofpoint APIs

• Identify the data needed for post-incident reporting
• Understand the purpose of key Proofpoint APIs
• Collect incident evidence using APIs and platform data
• Support post-incident reviews and lessons learned
• Understand what to include in an incident report