Symantec EDR 4.x Planning, Implementation and Administration Training (R1.1)
On-premises Symantec Endpoint Detection and Response (SEDR) helps security teams spot suspicious activity, investigate it and contain an attack. This three-day course follows Broadcom's published R1.1 outline: sizing and architecture, installation, then detection, investigation, response and reporting. It is aimed at teams running SEDR in their own infrastructure alongside Symantec Endpoint Protection, and it relies on hands-on exercises throughout.
The essentials
Publisher : Broadcom (Symantec)
Duration : 3 days
Level : Intermediate
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : No currently confirmed linked exam — contact us
Exam voucher: included or optional depending on the package — contact us.
Configure SEDR for endpoint detection and response
Recognise evidence of suspicious and malicious activity
Hunt for indicators of compromise
Block, isolate and remove threats
Collect forensic information
Manage system settings
Program
Introduction
Threat landscape and EDR challenges
SEDR components, shared technologies, add-ons and integrations
Architecture and sizing
Architecture options and sizing requirements
Implementation
Requirements, installation and setup wizard
Console, certificates, accounts and roles, SEP integration
Detecting threats
Understanding suspicious activity and configuring detection
Investigating threats
Advanced attack stages, IOCs and searches
EAR data analysis and investigation tools
Responding to threats
Isolation, blocking and removal
Tuning the environment
Reporting and forensics
Notifications, reports and post-incident reporting
Forensic data collection
Managing system settings
Incident rules, event forwarding and Splunk integration
Prerequisites
Familiarity with Symantec Endpoint Detection and Response and Symantec Endpoint Protection
Basic Windows and networking administration skills, including certificates and user account management
Target audience
IT security professionals in security operations roles
Systems administrators handling detection and response
Incident analysts running on-premises SEDR who need to investigate and document incidents
The exam
Broadcom publishes a study guide for the “Endpoint Detection and Response 4.x Technical Specialist” exam (250-571), which recommends this course and follows its topics. However, the June 2025 training catalog links the course to a different exam code, and we could not confirm that 250-571 is still offered. We check which exam is available with you before you register. The course remains fully useful without a certification: its main goal is operational mastery of the tool, so that your team can move from an alert to a documented, contained incident with confidence.
Preparation tips
Brush up on Symantec Endpoint Protection basics before the course
Bring real, anonymised incident cases for the investigation labs
Practise IOC searches in a lab after the course
Frequently asked questions (FAQ)
How does this differ from the Endpoint Security Complete course?
This course covers SEDR installed on premises. If you manage EDR from the SESC cloud console, Broadcom points you to the Endpoint Security Complete Administration course.
Does the course lead to a certification?
Broadcom has offered an EDR 4.x exam, but its current status still needs confirming. We tell you which option applies when you register, and the course content stays the same either way.
Do I need to already use SEDR?
Familiarity with SEDR and SEP is expected; production experience is not mandatory. If you are new to the product, we can share preparation reading beforehand so that the first day on architecture and sizing is easier to follow.
Which formats and languages?
Live online, in person in Casablanca or on-site at your organization, in French or English.
Is Securevalley a Broadcom partner?
No. This is independent training based on the outline Broadcom publishes, without Broadcom-branded courseware or official completion certificates.