> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/insight/getting-started/insight-training-course-3-hours.md). # INSIGHT Training Course - 3 Hours ## Overview This training gives users a practical introduction to INSIGHT. The objective is to help attendees deploy INSIGHT, configure core settings, and start monitoring user activities. It covers: * Product architecture and key components * Microsoft 365 and endpoint monitoring setup * Users, devices, policies, and organisation settings * Risk definitions, reporting, dashboards, and troubleshooting ### Duration * **Session 1** - 50 minutes * **Break** - 10 minutes * **Session 2** - 50 minutes * **Break** - 10 minutes * **Session 3** - 60 minutes ### Session 1 - 50 minutes #### Topics covered * INSIGHT overview * How to connect Microsoft 365/Cloud Monitor * How to deploy the INSIGHT Agent * How users and devices appear in INSIGHT * How to configure Organisation Settings #### 1. Product overview and architecture - 5 minutes Cover the product at a high level first. Explain: * What INSIGHT is * Where it fits in the data security workflow * How monitored activity becomes actionable risk Review the components: * **Management Console** * **INSIGHT Agent** * **Cloud Monitor** Then explain the two monitoring models. #### Endpoint monitoring * Agent installed on the endpoint * Monitors local user activity and data movement #### Cloud monitoring * Microsoft 365 integration connected in the console * Monitors Exchange Online and SharePoint Online activity #### 2. Microsoft 365 integration and console access - 10 minutes Walk through the first admin access path. Demonstrate: * Signing in to the Management Console * Connecting Microsoft 365 Then explain what the integration enables. * Exchange monitoring * SharePoint monitoring * Cloud activity visibility #### 3. Agent download and installation - 5 minutes Walk through agent preparation for monitoring. Demonstrate: * Agent configuration * Agent download * Agent installation 1. Configure the agent package from the console. 2. Download the installer. 3. Install the agent on a demo endpoint. 4. Confirm the device appears as online in INSIGHT. Trainer focus: * Show the minimum steps needed to get one device reporting * Point out any endpoint or security software exclusions needed #### 4. Users and devices - 20 minutes Cover: * **Devices** * Device Maintenance * Assigning commands * Retrieving logs * **End Users** Demonstrate * how synced users appear * how to uninstall and update the agent * how to retrieve logs * how to assign commands #### 5. Organisation Settings - 10 minutes Show the main organisational settings used to improve the monitoring context. Then explain the key Organisation Settings that improve monitoring context. Examples: * Working days * Websites and applications * Email domains and trusted emails ### Break - 10 minutes ### Session 2 - 50 minutes #### Topics covered * How to create and assign a User Policy * How to define risk levels * How to configure Advanced Settings * How to assign settings to devices * How to validate endpoint health #### 6. User Policies - 15 minutes Explain the user policy lifecycle. Demonstrate: * Creating a policy * Configuring monitored activities and data types * Setting control actions * Assigning users Use this simple demo example: * Monitor the AI website uploads * Warn on sensitive email attachments * Block selected file transfers Trainer focus: * Show the link between policy rules and captured events * Use one realistic policy example end to end #### 7. Risk Definitions - 10 minutes Explain how severity is assigned across monitored activities. Focus on the value: * Easier dashboard prioritisation * Better reporting context * Closer alignment with business risk #### 8. Advanced Settings - 20 minutes Explain the role of Advanced Settings first. Cover: * Communication and upload behaviour * Monitoring scope * Network and file-system monitoring * Device assignment Then demonstrate: * Creating an Advanced Setting * Changing one or two key monitoring options * Assigning the setting to a device Trainer focus: * Keep the demo to the highest-value settings * Show how to confirm the assigned setting on the endpoint #### 9. Endpoint health and troubleshooting - 5 minutes Demonstrate: * **INSIGHT Status Monitor** * Device online status * Last sync and applied settings Trainer focus: * Position this as the first check when data looks missing * Show how to confirm a policy or setting has applied ### Break - 10 minutes ### Session 3 - 60 minutes #### Topics covered * How to configure Cyber Awareness and Risk Summary reports * How to review dashboard data and drill into incidents * Common troubleshooting checks * Q\&A #### 10. Reports - 15 minutes Show the two main reporting paths. Demonstrate: * **Cyber Awareness** for end-user guidance * **Risk Summary** for admin visibility Explain when to use each report. Key point: * Cyber Awareness drives behaviour change * Risk Summary supports operational oversight #### 11. Dashboard and incident review - 25 minutes Demonstrate: * Opening the main dashboard * Reviewing high-level risk views * Drilling into incidents Start here so trainees can review activity at a higher level before moving into specific events. Cover these views: * **Risk Summary** * **Data Type Risks** * **Behaviour Risks** Trainer focus: * Show how to filter by user, device, and time * Show how to move from summary widgets into incident detail #### 12. Common troubleshooting checks - 15 minutes Cover: * Microsoft 365 connection status * Agent connectivity and sync timing * Policy and Advanced Setting assignment * Missing activity validation steps Trainer focus: * Use a simple troubleshooting path from symptom to cause * Keep the checks practical and repeatable #### 13. Q\&A - 5 minutes Leave time for open discussion. {% hint style="info" %} Prepare one policy example, one report example, and one dashboard drill-down in advance. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.guardware.com/insight/getting-started/insight-training-course-3-hours.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.