Course Description

This 4.5 hour course prepares IT and security practitioners to install, configure and use a Phantom server in their environment.


Instructor-led Training Schedule

Course Prerequisites


  • None


Course Topics

  • Phantom topics and concepts
  • Installation
  • Initial configuration
  • Apps and assets
  • User management
  • Ingesting data
  • Events and containers
  • Mission control 
  • Running actions and playbooks
  • Case management 
  • Multi tenancy
Course Objectives

Module 1 – Introduction & Installation

  • Describe Phantom operating concepts
  • Identify documentation and community resources
  • Identify installation options
  • Perform initial configuration

Module 2 – Apps and Assets

  • Describe how apps and assets work in Phantom
  • Add and configure new apps
  • Configure assets

Module 3 – Mission Control and Case Management

  • Use Mission Control to work on events
  • Manually run actions and examine action results
  • Manually run actions and playbooks
  • Use the vault to store related files

Module 4 – Case Management and Multi-tenancy

  • Use case management for complex investigations
  • Configure multi tenancy to enable use of Phantom by multiple
  • teams