Course Summary
After completing this course you should be able to:
• Explain how a SOC operates and describe the different types of services that are performed from a Tier 1 SOC analyst’s perspective.
• Explain Network Security Monitoring (NSM) tools that are available to the network security analyst.
• Explain the data that is available to the network security analyst.
• Describe the basic concepts and uses of cryptography.
• Describe security flaws in the TCP/IP protocol and how they can be used to attack networks and hosts.
• Understand common endpoint security technologies.
• Understand the kill chain and the diamond models for incident investigations, and the use of exploit kits by threat actors.
Identify resources for hunting cyber threats.
• Explain the need for event data normalization and event correlation.
•IIdentify the common attack vectors.
•IIdentify malicious activities.
• Identify patterns of suspicious behaviors.
• Conduct security incident investigations.
• Explain the use of a typical playbook in the SOC.
• Explain the use of SOC metrics to measure the effectiveness of the SOC.
• Explain the use of a workflow management system and automation to improve the effectiveness of the SOC.
• Describe a typical incident response plan and the functions of a typical CSIRT.
• Explain the use of VERIS to document security incidents in a standard format.
• Describe the Windows operating system features and functionality.
• Describe the Linux operating system features and functionality
Module 1: Security Operations Center (SOC) Overview
• Defining the Security Operations Center
Understanding SOC Metrics and Workflow
Module 2: Network Infrastructure and Security Monitoring
• Understanding Network Infrastructure and Network Security Monitoring Tools
• Exploring Data Type Categories
• Understanding Common TCP/IP Attacks
Module 3: Security Fundamentals
• Understanding Basic Cryptography Concepts
• Understanding Endpoint Security Technologies
• Understanding Windows and Linux Operating System Basics
Module 4: Incident Analysis and Response
• Understanding Incident Analysis in a Threat-Centric SOC
• Conducting Security Incident Investigations
• Describing Incident Response
• Using a Playbook Model to Organize Security Monitoring
Module 5: Threat Detection and Investigation
• Identifying Resources for Hunting Cyber Threats
• Identifying Common Attack Vectors
• Identifying Malicious Activity
• Identifying Patterns of Suspicious Behavior
• Understanding Event Correlation and Normalization
Module 6: Advanced Topics
• Understanding the Use of VERIS
• Understanding SOC Workflow and Automation
Other Popular Courses
CompTIA: SecurityX
- Duration: 5 Days
- Language: English
- Level: Advanced
- Exam: CAS-005
Executive Cyber Risk Certification (ECRC)
- Duration: 2 Days
- Language: English
- Level: Advanced
- Exam: ECRC
Mastering Communication & Presentation Te...
- Duration: 5 Days
- Language: Danish
- Level: Intermediate
- Exam: MCPT