INSIGHT Training Course - 3 Hours
Overview
This training gives users a practical introduction to INSIGHT.
The objective is to help attendees deploy INSIGHT, configure core settings, and start monitoring user activities.
It covers:
Product architecture and key components
Microsoft 365 and endpoint monitoring setup
Users, devices, policies, and organisation settings
Risk definitions, reporting, dashboards, and troubleshooting
Duration
Session 1 - 50 minutes
Break - 10 minutes
Session 2 - 50 minutes
Break - 10 minutes
Session 3 - 60 minutes
Session 1 - 50 minutes
Topics covered
INSIGHT overview
How to connect Microsoft 365/Cloud Monitor
How to deploy the INSIGHT Agent
How users and devices appear in INSIGHT
How to configure Organisation Settings
1. Product overview and architecture - 5 minutes
Cover the product at a high level first.
Explain:
What INSIGHT is
Where it fits in the data security workflow
How monitored activity becomes actionable risk
Review the components:
Management Console
INSIGHT Agent
Cloud Monitor
Then explain the two monitoring models.
Endpoint monitoring
Agent installed on the endpoint
Monitors local user activity and data movement
Cloud monitoring
Microsoft 365 integration connected in the console
Monitors Exchange Online and SharePoint Online activity
2. Microsoft 365 integration and console access - 10 minutes
Walk through the first admin access path.
Demonstrate:
Signing in to the Management Console
Connecting Microsoft 365
Then explain what the integration enables.
Exchange monitoring
SharePoint monitoring
Cloud activity visibility
3. Agent download and installation - 5 minutes
Walk through agent preparation for monitoring.
Demonstrate:
Agent configuration
Agent download
Agent installation
Configure the agent package from the console.
Download the installer.
Install the agent on a demo endpoint.
Confirm the device appears as online in INSIGHT.
Trainer focus:
Show the minimum steps needed to get one device reporting
Point out any endpoint or security software exclusions needed
4. Users and devices - 20 minutes
Cover:
Devices
Device Maintenance
Assigning commands
Retrieving logs
End Users
Demonstrate
how synced users appear
how to uninstall and update the agent
how to retrieve logs
how to assign commands
5. Organisation Settings - 10 minutes
Show the main organisational settings used to improve the monitoring context.
Then explain the key Organisation Settings that improve monitoring context.
Examples:
Working days
Websites and applications
Email domains and trusted emails
Break - 10 minutes
Session 2 - 50 minutes
Topics covered
How to create and assign a User Policy
How to define risk levels
How to configure Advanced Settings
How to assign settings to devices
How to validate endpoint health
6. User Policies - 15 minutes
Explain the user policy lifecycle.
Demonstrate:
Creating a policy
Configuring monitored activities and data types
Setting control actions
Assigning users
Use this simple demo example:
Monitor the AI website uploads
Warn on sensitive email attachments
Block selected file transfers
Trainer focus:
Show the link between policy rules and captured events
Use one realistic policy example end to end
7. Risk Definitions - 10 minutes
Explain how severity is assigned across monitored activities.
Focus on the value:
Easier dashboard prioritisation
Better reporting context
Closer alignment with business risk
8. Advanced Settings - 20 minutes
Explain the role of Advanced Settings first.
Cover:
Communication and upload behaviour
Monitoring scope
Network and file-system monitoring
Device assignment
Then demonstrate:
Creating an Advanced Setting
Changing one or two key monitoring options
Assigning the setting to a device
Trainer focus:
Keep the demo to the highest-value settings
Show how to confirm the assigned setting on the endpoint
9. Endpoint health and troubleshooting - 5 minutes
Demonstrate:
INSIGHT Status Monitor
Device online status
Last sync and applied settings
Trainer focus:
Position this as the first check when data looks missing
Show how to confirm a policy or setting has applied
Break - 10 minutes
Session 3 - 60 minutes
Topics covered
How to configure Cyber Awareness and Risk Summary reports
How to review dashboard data and drill into incidents
Common troubleshooting checks
Q&A
10. Reports - 15 minutes
Show the two main reporting paths.
Demonstrate:
Cyber Awareness for end-user guidance
Risk Summary for admin visibility
Explain when to use each report.
Key point:
Cyber Awareness drives behaviour change
Risk Summary supports operational oversight
11. Dashboard and incident review - 25 minutes
Demonstrate:
Opening the main dashboard
Reviewing high-level risk views
Drilling into incidents
Start here so trainees can review activity at a higher level before moving into specific events.
Cover these views:
Risk Summary
Data Type Risks
Behaviour Risks
Trainer focus:
Show how to filter by user, device, and time
Show how to move from summary widgets into incident detail
12. Common troubleshooting checks - 15 minutes
Cover:
Microsoft 365 connection status
Agent connectivity and sync timing
Policy and Advanced Setting assignment
Missing activity validation steps
Trainer focus:
Use a simple troubleshooting path from symptom to cause
Keep the checks practical and repeatable
13. Q&A - 5 minutes
Leave time for open discussion.
Last updated