For the complete documentation index, see llms.txt. This page is also available as Markdown.

INSIGHT Training Course - 3 Hours

Overview

This training gives users a practical introduction to INSIGHT.

The objective is to help attendees deploy INSIGHT, configure core settings, and start monitoring user activities.

It covers:

  • Product architecture and key components

  • Microsoft 365 and endpoint monitoring setup

  • Users, devices, policies, and organisation settings

  • Risk definitions, reporting, dashboards, and troubleshooting

Duration

  • Session 1 - 50 minutes

  • Break - 10 minutes

  • Session 2 - 50 minutes

  • Break - 10 minutes

  • Session 3 - 60 minutes

Session 1 - 50 minutes

Topics covered

  • INSIGHT overview

  • How to connect Microsoft 365/Cloud Monitor

  • How to deploy the INSIGHT Agent

  • How users and devices appear in INSIGHT

  • How to configure Organisation Settings

1. Product overview and architecture - 5 minutes

Cover the product at a high level first.

Explain:

  • What INSIGHT is

  • Where it fits in the data security workflow

  • How monitored activity becomes actionable risk

Review the components:

  • Management Console

  • INSIGHT Agent

  • Cloud Monitor

Then explain the two monitoring models.

Endpoint monitoring

  • Agent installed on the endpoint

  • Monitors local user activity and data movement

Cloud monitoring

  • Microsoft 365 integration connected in the console

  • Monitors Exchange Online and SharePoint Online activity

2. Microsoft 365 integration and console access - 10 minutes

Walk through the first admin access path.

Demonstrate:

  • Signing in to the Management Console

  • Connecting Microsoft 365

Then explain what the integration enables.

  • Exchange monitoring

  • SharePoint monitoring

  • Cloud activity visibility

3. Agent download and installation - 5 minutes

Walk through agent preparation for monitoring.

Demonstrate:

  • Agent configuration

  • Agent download

  • Agent installation

  1. Configure the agent package from the console.

  2. Download the installer.

  3. Install the agent on a demo endpoint.

  4. Confirm the device appears as online in INSIGHT.

Trainer focus:

  • Show the minimum steps needed to get one device reporting

  • Point out any endpoint or security software exclusions needed

4. Users and devices - 20 minutes

Cover:

  • Devices

    • Device Maintenance

    • Assigning commands

    • Retrieving logs

  • End Users

Demonstrate

  • how synced users appear

  • how to uninstall and update the agent

  • how to retrieve logs

  • how to assign commands

5. Organisation Settings - 10 minutes

Show the main organisational settings used to improve the monitoring context.

Then explain the key Organisation Settings that improve monitoring context.

Examples:

  • Working days

  • Websites and applications

  • Email domains and trusted emails

Break - 10 minutes

Session 2 - 50 minutes

Topics covered

  • How to create and assign a User Policy

  • How to define risk levels

  • How to configure Advanced Settings

  • How to assign settings to devices

  • How to validate endpoint health

6. User Policies - 15 minutes

Explain the user policy lifecycle.

Demonstrate:

  • Creating a policy

  • Configuring monitored activities and data types

  • Setting control actions

  • Assigning users

Use this simple demo example:

  • Monitor the AI website uploads

  • Warn on sensitive email attachments

  • Block selected file transfers

Trainer focus:

  • Show the link between policy rules and captured events

  • Use one realistic policy example end to end

7. Risk Definitions - 10 minutes

Explain how severity is assigned across monitored activities.

Focus on the value:

  • Easier dashboard prioritisation

  • Better reporting context

  • Closer alignment with business risk

8. Advanced Settings - 20 minutes

Explain the role of Advanced Settings first.

Cover:

  • Communication and upload behaviour

  • Monitoring scope

  • Network and file-system monitoring

  • Device assignment

Then demonstrate:

  • Creating an Advanced Setting

  • Changing one or two key monitoring options

  • Assigning the setting to a device

Trainer focus:

  • Keep the demo to the highest-value settings

  • Show how to confirm the assigned setting on the endpoint

9. Endpoint health and troubleshooting - 5 minutes

Demonstrate:

  • INSIGHT Status Monitor

  • Device online status

  • Last sync and applied settings

Trainer focus:

  • Position this as the first check when data looks missing

  • Show how to confirm a policy or setting has applied

Break - 10 minutes

Session 3 - 60 minutes

Topics covered

  • How to configure Cyber Awareness and Risk Summary reports

  • How to review dashboard data and drill into incidents

  • Common troubleshooting checks

  • Q&A

10. Reports - 15 minutes

Show the two main reporting paths.

Demonstrate:

  • Cyber Awareness for end-user guidance

  • Risk Summary for admin visibility

Explain when to use each report.

Key point:

  • Cyber Awareness drives behaviour change

  • Risk Summary supports operational oversight

11. Dashboard and incident review - 25 minutes

Demonstrate:

  • Opening the main dashboard

  • Reviewing high-level risk views

  • Drilling into incidents

Start here so trainees can review activity at a higher level before moving into specific events.

Cover these views:

  • Risk Summary

  • Data Type Risks

  • Behaviour Risks

Trainer focus:

  • Show how to filter by user, device, and time

  • Show how to move from summary widgets into incident detail

12. Common troubleshooting checks - 15 minutes

Cover:

  • Microsoft 365 connection status

  • Agent connectivity and sync timing

  • Policy and Advanced Setting assignment

  • Missing activity validation steps

Trainer focus:

  • Use a simple troubleshooting path from symptom to cause

  • Keep the checks practical and repeatable

13. Q&A - 5 minutes

Leave time for open discussion.

Prepare one policy example, one report example, and one dashboard drill-down in advance.

Last updated