Security Operations and Incident Response Course

What you will learn in 7 lessons

1. 1

   Security Monitoring and Log Analysis

   Start here

   Collect and analyze logs from networks, hosts, cloud services and applications, tune SIEM detections and triage alerts to separate real incidents from noise.

   6 learning goals

   What you will learn

   1. 1.Collect and prepare log data for security monitoring
   2. 2.Recognize indicators of malicious activity in network, host and application logs
   3. 3.Monitor cloud and identity activity
   4. 4.Use baselines and SIEM correlation to find suspicious patterns
   5. 5.Triage alerts and separate real incidents from noise
   6. 6.Engineer and tune detections
2. 2

   Threat Intelligence and Threat Hunting

   Use threat intelligence sources and frameworks such as MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model to prioritize defenses and hunt for hidden threats.

   6 learning goals

   What you will learn

   1. 1.Explain what threat intelligence is and where it comes from
   2. 2.Analyze indicators of compromise and adversary TTPs
   3. 3.Use MITRE ATT&CK to describe and defend against adversary behavior
   4. 4.Model intrusions with the Cyber Kill Chain and the Diamond Model
   5. 5.Hunt for threats that evaded detection
   6. 6.Share intelligence and use it to drive defense
3. 3

   Analyzing Network and Endpoint Activity

   Analyze packet captures, flow data, suspicious emails and endpoint behavior, and use sandboxes and EDR tools to judge whether activity is malicious.

   5 learning goals

   What you will learn

   1. 1.Analyze network traffic in packet captures and flow data
   2. 2.Investigate suspicious email
   3. 3.Investigate endpoint activity with EDR
   4. 4.Analyze suspicious files and their reputation
   5. 5.Correlate evidence and judge whether activity is malicious
4. 4

   Vulnerability Management

   Run a vulnerability management program that scans assets, interprets results, prioritizes fixes with CVSS and business context and tracks remediation and exceptions.

   6 learning goals

   What you will learn

   1. 1.Set up a vulnerability management program
   2. 2.Plan and run vulnerability scans
   3. 3.Interpret and validate scan results
   4. 4.Prioritize vulnerabilities
   5. 5.Treat vulnerabilities and prove they are fixed
   6. 6.Manage application and cloud vulnerabilities
5. 5

   Incident Response Management

   Handle incidents from preparation through detection, containment, eradication and recovery, preserve evidence and run post-incident reviews.

   6 learning goals

   What you will learn

   1. 1.Prepare an organization to handle incidents
   2. 2.Detect, analyze and prioritize incidents
   3. 3.Preserve evidence and apply forensics basics
   4. 4.Contain, eradicate and recover
   5. 5.Respond to ransomware attacks
   6. 6.Learn from incidents
6. 6

   Security Automation and Orchestration

   Automate repetitive security tasks with scripts, APIs and SOAR playbooks, and judge which steps should stay with human analysts.

   5 learning goals

   What you will learn

   1. 1.Explain how automation and orchestration improve security operations
   2. 2.Standardize SOC workflows as playbooks
   3. 3.Write scripts that automate analyst tasks
   4. 4.Connect security tools through APIs and enrich alerts
   5. 5.Keep human judgment in charge of automated and AI-assisted work
7. 7

   Security Reporting and Communication

   Report vulnerabilities and incidents to technical teams, management and regulators with clear metrics, timelines and recommendations.

   6 learning goals

   What you will learn

   1. 1.Plan who needs to know what, when and how
   2. 2.Report vulnerabilities so they get fixed
   3. 3.Report incidents from declaration to final report
   4. 4.Meet regulatory, contractual and legal reporting duties
   5. 5.Measure and present security operations performance
   6. 6.Learn from incidents and close the loop