AX280 Enterprise Remote Endpoint Investigations
Remote collection isn't a lecture topic — it's a skill you develop. This course is engineered from the ground up around live, hands-on acquisition. Rather than working from static disk images, students target real, running endpoints across Windows, macOS, and Linux — the same way as in the field. Every module pairs concept with practice, providing the ability to perform remote collections and not just describe them.
Description
Remote collection isn't a lecture topic — it's a skill you develop.
This course is engineered from the ground up around live, hands-on acquisition. Rather than working from static disk images, students target real, running endpoints across Windows, macOS, and Linux — the same way as in the field. Every module pairs concept with practice, providing the ability to perform remote collections and not just describe them.
A realistic, evolving investigation
The course is built around a unified investigative scenario that grows with you. Each module introduces a new employee of interest, layering in fresh background and evidence, then puts you to work investigating them using the remote collection techniques you've just learned. Purpose-built user accounts and curated artifacts are staged on the target systems, giving you authentic "subjects" to acquire and analyze at every stage. The modular design means the scenario stays fresh and current — and consistently relevant to real-world enterprise investigations.
Built for true hands-on learning
To make live, in-classroom remote acquisition possible, each mobile lab is equipped with a dedicated wireless access point — enabling students to create, deploy, and run collection agents against one another's machines across realistic network configurations. The course supports in-person, classroom, and virtual delivery, including cloud-based lab environments where each student works in their own isolated VM.
What to expect
The ability to plan and execute remote collections across Windows, macOS, and Linux; confidence navigating segmented enterprise networks; fluency with Axiom Cyber, Magnet Nexus, Hybrid agents, and Magnet Response; and the troubleshooting instincts that separate practitioners who understand remote acquisition from those who can actually do it.
Course modules
Module 1: Course Introduction & Lab Environment
- Orientation to the course, the investigative scenario, and the hands-on lab setup.
Module 2: DFIR Concepts for Remote Acquisition
- The core principles and decision-making behind modern remote collection.
Module 3: Axiom Cyber Architecture & Workflow
-
A fully hands-on tour of creating, managing, and deploying remote collection agents across Windows, macOS, and Linux using Axiom Cyber.
Module 4: Windows Endpoint Collection
-
Students deploy an agent and run a targeted collection against their own machine, then process and review the artifacts in Axiom Cyber — building core skills with no network complexity to distract.
Module 5: Remote Collection Fundamentals
-
Working in teams across a shared private network, students deploy agents and collect from one another's endpoints, putting the full remote workflow into practice.
Module 6: Network Collection: Windows Endpoint via Axiom Cyber Agent.
-
Grounded in the realities of network segmentation, DNS, IP addressing, firewall rules, and authentication, students perform cross-VLAN collections by hostname and develop the connectivity troubleshooting skills that define real-world remote acquisition work.
Module 7: Magnet Nexus & Hybrid Agents
-
A closer look at Nexus, including creating cases, generating agents, and watching collections come to life as agents call home.
Module 8: Network Collection: macOS via Nexus Agent
- Extending remote collection to macOS endpoints using the Nexus agent.
Module 9: Network Collection: Linux Endpoint via Hybrid Agent
- Acquiring from a Linux target populated with scenario data, including coverage of MCAG/UCAG collection approaches.
Module 10: Magnet Response & Triage Lab.
- Where Response fits in the toolkit, when to use it, and how it complements Axiom Cyber and Nexus — with a hands-on lab running Response, reviewing artifacts in Examine, and validating the collection.
Module 11: Automation & Wrap-Up
- Automating remote agent deployment through EDR/SOAR workflows and base-image integration, leveraging Magnet Response within EDR alert response, and best practices for collection decision-making and avoiding over-collection.
Module 12: Capstone Exercise.
- A segmented, hands-on challenge that reinforces every skill from the week — and serves as a take-home practice resource to keep building after class.
Additional information
Who should attend: Participants who are unfamiliar with the principles of digital forensics
Advanced preparation: None
Program level: Intermediate
Field of study: Computer software & applications
Delivery method: Group live & Group internet based
Refunds and cancellations: Training Course(s) can be rescheduled to a later date or cancelled by either Magnet Forensics or you without charge or penalty if written notice is received twenty-one (21) days or more prior to the date of the Training Course. No rescheduling shall be permitted on less than twenty-one (21) days written notice, which shall constitute a cancellation without a refund. Your written rescheduling or cancellation notice must be emailed to training@magnetforensics.com or contact 202.984.3417. If Magnet Forensics cancels a Training Course due to insufficient attendance, you will have the option to register in a different scheduled Training Course or receive a full refund. Please do not book travel until you have confirmed that the Training Course will be running.
Magnet Forensics is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website:www.nasbaregistry.org.