INSIGHT Training Course - 3 Hours

Overview

This training gives users a practical introduction to INSIGHT.

The objective is to help attendees deploy INSIGHT, configure core settings, and start monitoring user activities.

It covers:

• Product architecture and key components
• Microsoft 365 and endpoint monitoring setup
• Users, devices, policies, and organisation settings
• Risk definitions, reporting, dashboards, and troubleshooting

Duration

• Session 1 - 50 minutes
• Break - 10 minutes
• Session 2 - 50 minutes
• Break - 10 minutes
• Session 3 - 60 minutes

Session 1 - 50 minutes

Topics covered

• INSIGHT overview
• How to connect Microsoft 365/Cloud Monitor
• How to deploy the INSIGHT Agent
• How users and devices appear in INSIGHT
• How to configure Organisation Settings

1. Product overview and architecture - 5 minutes

Cover the product at a high level first.

Explain:

• What INSIGHT is
• Where it fits in the data security workflow
• How monitored activity becomes actionable risk

Review the components:

• Management Console
• INSIGHT Agent
• Cloud Monitor

Then explain the two monitoring models.

Endpoint monitoring

• Agent installed on the endpoint
• Monitors local user activity and data movement

Cloud monitoring

• Microsoft 365 integration connected in the console
• Monitors Exchange Online and SharePoint Online activity

2. Microsoft 365 integration and console access - 10 minutes

Walk through the first admin access path.

Demonstrate:

• Signing in to the Management Console
• Connecting Microsoft 365

Then explain what the integration enables.

• Exchange monitoring
• SharePoint monitoring
• Cloud activity visibility

3. Agent download and installation - 5 minutes

Walk through agent preparation for monitoring.

Demonstrate:

• Agent configuration
• Agent download
• Agent installation

1. Configure the agent package from the console.
2. Download the installer.
3. Install the agent on a demo endpoint.
4. Confirm the device appears as online in INSIGHT.

Trainer focus:

• Show the minimum steps needed to get one device reporting
• Point out any endpoint or security software exclusions needed

4. Users and devices - 20 minutes

Cover:

• Devices

  • Device Maintenance
  • Assigning commands
  • Retrieving logs
• End Users

Demonstrate

• how synced users appear
• how to uninstall and update the agent
• how to retrieve logs
• how to assign commands

5. Organisation Settings - 10 minutes

Show the main organisational settings used to improve the monitoring context.

Then explain the key Organisation Settings that improve monitoring context.

Examples:

• Working days
• Websites and applications
• Email domains and trusted emails

Break - 10 minutes

Session 2 - 50 minutes

Topics covered

• How to create and assign a User Policy
• How to define risk levels
• How to configure Advanced Settings
• How to assign settings to devices
• How to validate endpoint health

6. User Policies - 15 minutes

Explain the user policy lifecycle.

Demonstrate:

• Creating a policy
• Configuring monitored activities and data types
• Setting control actions
• Assigning users

Use this simple demo example:

• Monitor the AI website uploads
• Warn on sensitive email attachments
• Block selected file transfers

Trainer focus:

• Show the link between policy rules and captured events
• Use one realistic policy example end to end

7. Risk Definitions - 10 minutes

Explain how severity is assigned across monitored activities.

Focus on the value:

• Easier dashboard prioritisation
• Better reporting context
• Closer alignment with business risk

8. Advanced Settings - 20 minutes

Explain the role of Advanced Settings first.

Cover:

• Communication and upload behaviour
• Monitoring scope
• Network and file-system monitoring
• Device assignment

Then demonstrate:

• Creating an Advanced Setting
• Changing one or two key monitoring options
• Assigning the setting to a device

Trainer focus:

• Keep the demo to the highest-value settings
• Show how to confirm the assigned setting on the endpoint

9. Endpoint health and troubleshooting - 5 minutes

Demonstrate:

• INSIGHT Status Monitor
• Device online status
• Last sync and applied settings

Trainer focus:

• Position this as the first check when data looks missing
• Show how to confirm a policy or setting has applied

Break - 10 minutes

Session 3 - 60 minutes

Topics covered

• How to configure Cyber Awareness and Risk Summary reports
• How to review dashboard data and drill into incidents
• Common troubleshooting checks
• Q&A

10. Reports - 15 minutes

Show the two main reporting paths.

Demonstrate:

• Cyber Awareness for end-user guidance
• Risk Summary for admin visibility

Explain when to use each report.

Key point:

• Cyber Awareness drives behaviour change
• Risk Summary supports operational oversight

11. Dashboard and incident review - 25 minutes

Demonstrate:

• Opening the main dashboard
• Reviewing high-level risk views
• Drilling into incidents

Start here so trainees can review activity at a higher level before moving into specific events.

Cover these views:

• Risk Summary
• Data Type Risks
• Behaviour Risks

Trainer focus:

• Show how to filter by user, device, and time
• Show how to move from summary widgets into incident detail

12. Common troubleshooting checks - 15 minutes

Cover:

• Microsoft 365 connection status
• Agent connectivity and sync timing
• Policy and Advanced Setting assignment
• Missing activity validation steps

Trainer focus:

• Use a simple troubleshooting path from symptom to cause
• Keep the checks practical and repeatable

13. Q&A - 5 minutes

Leave time for open discussion.

Prepare one policy example, one report example, and one dashboard drill-down in advance.